[Xen-changelog] [xen-unstable] [BLKTAP] Fix blktap oops on domain shutdown

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Andrew Warfield <andy@xxxxxxxxxxxxx>
# Node ID f9929b7e009e03fe7a9b53ad31e5213596c03b9b
# Parent  b6ee084892dad84750bb8aa3fb89056c3aa21633
[BLKTAP] Fix blktap oops on domain shutdown
When a domain shuts down with a blktap-backed block device open, it can
easily cause a dom0 oops.  The XenbusStateClosing event can occur while
the tapdisk userland thread is still processing IO requests (eg.
readaheads) from the domU.  But the xenbus state handler calls
tap_blkif_unmap(), unmapping the blkif->blk_ring.sring rin buffer, so
when the tapdisk thread next calls the BLKTAP_IOCTL_KICK_FE to return
the completion event to the FE via that ring buffer, it oopses.

This can be fixed simply by not calling tap_blkif_unmap() in this case;
the ring buffer will still be unmapped later on when the blkif is
destroyed by blktap_remove(), only then it will properly wait for the
blkif refcnt to reach zero before doing so.

Signed-off-by: Stephen Tweedie <sct@xxxxxxxxxx>
---
 linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c |    1 -
 1 files changed, 1 deletion(-)

diff -r b6ee084892da -r f9929b7e009e 
linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Thu Sep 28 17:10:54 
2006 +0100
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Thu Sep 28 11:41:23 
2006 -0700
@@ -273,7 +273,6 @@ static void tap_frontend_changed(struct 
                        kthread_stop(be->blkif->xenblkd);
                        be->blkif->xenblkd = NULL;
                }
-               tap_blkif_unmap(be->blkif);
                xenbus_switch_state(dev, XenbusStateClosing);
                break;
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog