Pkg xen devel - Jul 2012 - Bug#665433: hypervisor fault in move_masked_irq

tags 665433 +upstream
thanks

Hi Andrew,

This [0] Debian bug report (against 4.0) looks like the sort of thing
you might have fixed (or perhaps worked around) in one of your many
fixes to the IRQ stuff in 4.1/unstable. Does it look at all familiar?

Cheers,
Ian.

[0] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665433

Processing commands for control at bugs.debian.org:
> tags 665433 +upstream
Bug #665433 [xen-hypervisor-4.0-i386] xen hypervisor FATAL PAGE FAULT after
linux kernel BUG: unable to handle kernel paging request
Added tag(s) upstream.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
665433: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665433
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems

On 14/07/12 21:46, Ian Campbell wrote:
> tags 665433 +upstream
> thanks
>
> Hi Andrew,
>
> This [0] Debian bug report (against 4.0) looks like the sort of thing
> you might have fixed (or perhaps worked around) in one of your many
> fixes to the IRQ stuff in 4.1/unstable. Does it look at all familiar?
Unfortunately it doesn't look too familiar.

Judging by the fact that Xen has jumped outside of its code space, I
would say that Xen has made a function call off an invalid function pointer.

Given that desc->handler->set_affinity() is the only function pointer
call in the function, this is possibly a race condition between dom0
dying (which the upper stack trace indicates), Xen cleaning up after
dom0, and Xen receiving an interrupt which was midway through being
migrated.

Furthermore, it appears that unstable might be vulnerable to the same
race condition.

~Andrew
>
> Cheers,
> Ian.
>
> [0] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665433
>
-- 
Andrew Cooper - Dom0 Kernel Engineer, Citrix XenServer
T: +44 (0)1223 225 900, http://www.citrix.com