From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jeremy Fitzhardinge <jeremy@goop.org>
Subject: Crash on blktap shutdown
Date: Wed, 24 Feb 2010 14:55:24 -0800
Message-ID: <4B85AE5C.8050603@goop.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Daniel Stodden <Daniel.Stodden@citrix.com>
Cc: Xen-devel <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

When rebooting the machine,  I got this crash from blktap.  The rip maps to line 262 in
0xffffffff812548a1 is in blktap_request_pool_free (/home/jeremy/git/linux/drivers/xen/blktap/request.c:262).
257		spin_lock_irqsave(&pool.lock, flags);
258	
259		pool.status = BLKTAP_POOL_CLOSING;
260		while (atomic_read(&pool.reqs_in_use)) {
261			spin_unlock_irqrestore(&pool.lock, flags);
262			wait_event(pool.wait_queue, !atomic_read(&pool.reqs_in_use));
263			spin_lock_irqsave(&pool.lock, flags);
264		}
265	
266		for (i = 0; i<  MAX_BUCKETS; i++) {


blktap_ring_vm_close: unmapping ring 6
blktap_ring_release: freeing device 6
general protection fault: 0000 [#2] SMP DEBUG_PAGEALLOC
last sysfs file: /sys/devices/virtual/net/eth0/address
CPU 1
Modules linked in: e1000 evdev ahci dm_mod sd_mod mptspi mptscsih mptbase scsi_]
Pid: 993, comm: tapdisk2 Tainted: G      D    2.6.32.8 #355 PowerEdge 1850
RIP: e030:[<ffffffff8125413b>]  [<ffffffff8125413b>] blktap_device_restart+0x7a8
RSP: e02b:ffff88002d767be8  EFLAGS: 00010092
RAX: ffff88002ea06b08 RBX: ffff88002f319090 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 6b6b6b6b6b6b6b6b
RBP: ffff88002d767bf8 R08: 0000000000000002 R09: 0000000000000001
R10: ffffffff8125412d R11: ffffffff811eaa4a R12: ffff88002f319330
R13: ffff88002f3191b8 R14: ffff8800242a3a50 R15: 0000000000000001
FS:  00007f7e3234a740(0000) GS:ffff8800028fb000(0000) knlGS:0000000000000000
CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00000036a05a8d84 CR3: 000000002d364000 CR4: 0000000000000660
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process tapdisk2 (pid: 993, threadinfo ffff88002d766000, task ffff8800242c3d00)
Stack:
  ffff88002f319090 ffff88002f319238 ffff88002d767c28 ffffffff81251b3b
<0>  ffff8800242a3a50 ffff88002f2c2870 ffff880002909820 ffff88002400ad60
<0>  ffff88002d767c48 ffffffff8109aead ffff8800242a3a50 ffff88002400ad00
Call Trace:
  [<ffffffff81251b3b>] blktap_ring_vm_close+0x39/0x12d
  [<ffffffff8109aead>] remove_vma+0x3b/0x71
  [<ffffffff8109b036>] exit_mmap+0x153/0x175
  [<ffffffff8103eef6>] mmput+0x3e/0xd9
  [<ffffffff81042b83>] exit_mm+0x100/0x10b
  [<ffffffff81044416>] do_exit+0x1b9/0x638
  [<ffffffff8104d797>] ? get_signal_to_deliver+0x2dd/0x36e
  [<ffffffff8100efef>] ? xen_restore_fl_direct_end+0x0/0x1
  [<ffffffff81044908>] do_group_exit+0x73/0x9c
  [<ffffffff8104d809>] get_signal_to_deliver+0x34f/0x36e
  [<ffffffff810111c4>] do_signal+0x6d/0x6b0
  [<ffffffff8104ef1f>] ? sys_getsid+0x88/0xaf
  [<ffffffff810bd680>] ? poll_select_copy_remaining+0xc9/0xee
  [<ffffffff8101182e>] do_notify_resume+0x27/0x47
  [<ffffffff81390f80>] ? trace_hardirqs_on_thunk+0x3a/0x3f
  [<ffffffff810549ef>] ? remove_wait_queue+0x12/0x45
  [<ffffffff81011f56>] int_signal+0x12/0x17
Code: a8 01 74 0a 48 89 df e8 24 e6 ff ff eb 46 4c 8d a3 a0 02 00 00 4c 89 e7 e
RIP  [<ffffffff8125413b>] blktap_device_restart+0x7a/0xa8
  RSP<ffff88002d767be8>
---[ end trace 1b88501e9b8effb5 ]---

	J