[Xen-devel] Xen crash in kill_timer on domain destruction

[Jeremy Fitzhardinge <jeremy@xxxxxxxx>]

I just got this when doing an xl destroy on an hvm domain and its stubdom.
I think it was xen-unstable at change 5aabc6f94df5; I hadn't picked up
4ab68bf4c37e.

        J

(XEN) ----[ Xen-4.1-unstable  x86_64  debug=y  Not tainted ]----
(XEN) CPU:    3
(XEN) RIP:    e008:[<ffff82c480121fe7>] kill_timer+0xfa/0x203
(XEN) RFLAGS: 0000000000010046   CONTEXT: hypervisor
(XEN) rax: 0000000000000000   rbx: ffff82c4802b9380   rcx: ffff8301c5b60420
(XEN) rdx: 0000000000100100   rsi: 00000000001dde47   rdi: ffff8301c5b60410
(XEN) rbp: ffff83023ff0fd50   rsp: ffff83023ff0fd10   r8:  0000000000000000
(XEN) r9:  0200000000000000   r10: 0000000000000001   r11: 0080000000000000
(XEN) r12: ffff82c4802b9380   r13: ffff8301c5b60410   r14: 0000000000000000
(XEN) r15: ffff82c4802a71a0   cr0: 000000008005003b   cr4: 00000000000026f0
(XEN) cr3: 000000022c971000   cr2: 0000000000100108
(XEN) ds: 002b   es: 002b   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83023ff0fd10:
(XEN)    ffff83023fff5868 0000000000000207 ffff8301c5b60000 ffff8301c5b60000
(XEN)    ffff8301c5b60000 00000000ffffffff ffff83023ff0ff28 fffffffffffffffd
(XEN)    ffff83023ff0fd70 ffff82c4801a7900 00000000a0a0a0a1 ffff8301c5b60000
(XEN)    ffff83023ff0fd90 ffff82c48019de20 ffff83023ff0fdb0 ffff8301c5b60000
(XEN)    ffff83023ff0fdb0 ffff82c48014eed3 ffff8301c5b60000 ffff8300bf2f2000
(XEN)    ffff83023ff0fde0 ffff82c480104010 ffff83023ff0fe10 ffff83023ff13220
(XEN)    0000000000000000 0000000000000000 ffff83023ff0fe10 ffff82c4801259aa
(XEN)    00000000ffffffff ffff82c480294a00 00000000ffffffff ffff82c480294880
(XEN)    ffff83023ff0fe50 ffff82c48011ee23 ffff83023882e6b0 ffff83023882e5f0
(XEN)    ffff83023882e6b0 0000000000000003 ffff83023ff13080 0000000000000002
(XEN)    ffff83023ff0fe60 ffff82c48011ee90 ffff83023ff0fef0 ffff82c48018e56f
(XEN)    ffffffffffffffff ffff83023ff0ff28 ffff83023ff0ff28 ffff8300bf4be000
(XEN)    ffffffffffffffff 000000003ff0fec8 0000000000000000 0000000000000000
(XEN)    ffff82c480294880 0000013e000004a4 ffffffffffffffff ffff83023ff0ff28
(XEN)    ffff82c480245ac0 ffff83023ff0ff28 ffff83023ff13080 0000000000000002
(XEN)    ffff83023ff0ff20 ffff82c48014e44f 0000000000000000 ffff8300bf4be000
(XEN)    ffff8300bf786000 00000000ffffffff ffff83023ff0fdc8 0000000000000000
(XEN)    0000000000000000 0000000000000000 ffffffff8178b610 ffff8800beed5ef0
(XEN)    ffff8800beed4000 0000000000000246 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 ffffffff810093aa ffff8800beeb3000
(XEN) Xen call trace:
(XEN)    [<ffff82c480121fe7>] kill_timer+0xfa/0x203
(XEN)    [<ffff82c4801a7900>] rtc_deinit+0x30/0x43
(XEN)    [<ffff82c48019de20>] hvm_domain_destroy+0x1a/0x39
(XEN)    [<ffff82c48014eed3>] arch_domain_destroy+0x18/0x2cf
(XEN)    [<ffff82c480104010>] complete_domain_destroy+0x64/0x118
(XEN)    [<ffff82c4801259aa>] rcu_process_callbacks+0x15c/0x1b7
(XEN)    [<ffff82c48011ee23>] __do_softirq+0x8d/0x9e
(XEN)    [<ffff82c48011ee90>] process_pending_softirqs+0x4c/0x5c
(XEN)    [<ffff82c48018e56f>] acpi_processor_idle+0x179/0x54a
(XEN)    [<ffff82c48014e44f>] idle_loop+0x5a/0x67
(XEN)    
(XEN) Pagetable walk from 0000000000100108:
(XEN)  L4[0x000] = 000000022644c067 00000000000b137f
(XEN)  L3[0x000] = 000000022e127067 00000000000b8ea4
(XEN)  L2[0x000] = 0000000000000000 ffffffffffffffff 
(XEN) 
(XEN) ****************************************
(XEN) Panic on CPU 3:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: 0000000000100108
(XEN) ****************************************
(XEN) 
(XEN) Reboot in five seconds...



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel