http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=90
------- Additional Comments From ryanh@xxxxxxxxxx 2005-08-18 17:36 -------
Debugging this some more, and there are two ways to get into br_del_if()
function which calls the sysfs call which ultimately oops when the
dentry->d_count is 0. One way is from the bridge IOCTL, the function
add_del_if() which presumably is called from brctl in some manner (I've not
looked at the code). The other path is from the bridges notifier block which
registers for net_dev events, the handler is br_device_event, on
NETDEV_UNREGISTER event, it calls br_del_if().
In this bug's case, the IOCTL is triggered from brctl to take out the vif, and
br_del_if() is called once, then for some reason, the notifier chain triggers
and calls br_del_if() a second time. I've not figured out WHY the chain isnt
called every time the vif is removed, but whenever the notify chain is called,
it is called on a bridge port that has already been removed.
Here is some trace info:
*DOMU Created *
xen-br0: port 3(vif20.0) entering learning state
xen-br0: topology change detected, propagating
xen-br0: port 3(vif20.0) entering forwarding state
*DOMU Destroyed, brctl down called sending IOCTL *
WARK: add_del_if() calling br_del_if(db8e0240,d9b82c00)
WARK: calling br_sysfs_removeif(p=3)
WARK: calling delete on &p->kobj
WARK: del_nbp running on da77adc0
xen-br0: port 3(vif20.0) entering disabled state
xen-br0: port 3(vif20.0) entering disabled state
WARK: calling unregister_netdev(-642241536)
* Everything OK, notifier chain not called *
* DOMU Created *
xen-br0: port 3(vif21.0) entering learning state
xen-br0: topology change detected, propagating
xen-br0: port 3(vif21.0) entering forwarding state
* DOMU Destroyed, brctl down called sending IOCTL *
WARK: add_del_if() calling br_del_if(db8e0240,db105400)
WARK: calling br_sysfs_removeif(p=3)
WARK: calling delete on &p->kobj
WARK: del_nbp running on daa87ec0
xen-br0: port 3(vif21.0) entering disabled state
xen-br0: port 3(vif21.0) entering disabled state
WARK: calling unregister_netdev(-619686912)
* For some reason the notifier is triggered *THIS TIME*
* and we call br_del_if() a second time on same br and port
WARK: notify chain calling br_del_if(db8e0240,db105400)
WARK: calling br_sysfs_removeif(p=3)
* ooops, not suppose to call dget on d_count=0 *
* DOM0/Xen go BOOM *
Next thing is to hack up the br_device_event() to see what events are coming
through.
--
Configure bugmail:
http://bugzilla.xensource.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
_______________________________________________
Xen-bugs mailing list
Xen-bugs@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-bugs
|
Home