ARM64 DOM0 crashing after commit 578270b "block: fix segment split"

[Julien Grall]

Hello,

I've been trying the Linux 4.4-rc3 on mustang (ARM64) with Xen.
DOM0 is crashing as soon as a guest is started when QDISK is
used for the disk:

------------[ cut here ]------------
WARNING: at /home/julien/works/linux/block/blk-merge.c:435
Modules linked in:

CPU: 6 PID: 0 Comm: swapper/6 Not tainted 4.4.0-rc3 #276
Hardware name: APM X-Gene Mustang board (DT)
task: ffffffc1f6d13700 ti: ffffffc1f6d2c000 task.ti: ffffffc1f6d2c000
PC is at blk_rq_map_sg+0x3dc/0x4a4
LR is at blk_rq_map_sg+0x454/0x4a4
pc : [<ffffffc00035bc78>] lr : [<ffffffc00035bcf0>] pstate: 200001c5
sp : ffffffc1f6d2f8a0
x29: ffffffc1f6d2f8a0 x28: 0000000000000020 
x27: ffffffc1f5ccc000 x26: ffffffc1f6166740 
x25: 000000000000000b x24: ffffffc0fa11e000 
x23: ffffffc1f6166740 x22: ffffffc1f5ccc1f0 
x21: 0000000000000000 x20: 0000000000000000 
x19: 0000000000000000 x18: 0000000000000007 
x17: 000000000000000e x16: 0000000000000001 
x15: 0000000000000019 x14: 0000000000000033 
x13: 000000000000004c x12: 0000000000000068 
x11: ffffffc1f6d2fbd0 x10: ffffffc1f62e0000 
x9 : 0000000000000000 x8 : ffffffc1f6166740 
x7 : 0000000000000000 x6 : 0000000000000000 
x5 : 0000000000001000 x4 : 0000000000001000 
x3 : 0000000000001000 x2 : 00000042f2e4c000 
x1 : 0000000000000000 x0 : 000000000000000a 

---[ end trace 247f3acfda1a2560 ]---
Call trace:
[<ffffffc00035bc78>] blk_rq_map_sg+0x3dc/0x4a4
[<ffffffc000473b34>] scsi_init_sgtable+0x70/0xd8
[<ffffffc000473bd4>] scsi_init_io+0x38/0x108
[<ffffffc00047c858>] sd_init_command+0x44/0x9c4
[<ffffffc000473d6c>] scsi_setup_cmnd+0xc8/0x11c
[<ffffffc000473e78>] scsi_prep_fn+0xb8/0x138
[<ffffffc00035739c>] blk_peek_request+0x150/0x204
[<ffffffc000474850>] scsi_request_fn+0x4c/0x5ac
[<ffffffc000353978>] __blk_run_queue+0x34/0x4c
[<ffffffc000353b80>] blk_run_queue+0x24/0x3c
[<ffffffc000472cfc>] scsi_run_queue+0x204/0x290
[<ffffffc000473728>] scsi_end_request+0x128/0x188
[<ffffffc000474ed0>] scsi_io_completion+0x98/0x514
[<ffffffc00046d910>] scsi_finish_command+0xc4/0x110
[<ffffffc0004747d4>] scsi_softirq_done+0x130/0x160
[<ffffffc00035d160>] blk_done_softirq+0x7c/0x94
[<ffffffc0000b8a30>] __do_softirq+0xfc/0x200
[<ffffffc0000b8d84>] irq_exit+0x84/0xd8
[<ffffffc00008ec7c>] handle_IPI+0x104/0x19c
[<ffffffc000082510>] gic_handle_irq+0x84/0x9c
Exception stack(0xffffffc1f6d2fe00 to 0xffffffc1f6d2ff20)
fe00: ffffffc000966000 ffffffc000966a68 ffffffc1f6d2ff50 ffffffc0000867f0
fe20: 0000000060000145 0000000a489e3200 0000000000000000 0000000000000000
fe40: 0000000000000001 ffffffc00096a000 0000000000000001 ffffffc1fff9a048
fe60: ffffffc1f6fbef08 ffffffc1fff9a188 00000000ffff0594 ffffffc1f6d2fec0
fe80: 0000000000000740 ffffffc1f6276370 0000000000000018 00000003e8000000
fea0: 0000000000000000 000a9e23fc000000 ffffffc0001a34d4 0000007f8a8d2820
fec0: 0000007f89432760 ffffffc000966000 ffffffc000966a68 ffffffc000946ac0
fee0: ffffffc1f6d2ff70 ffffffc00094a1e8 ffffffc000677978 ffffffc000966000
ff00: ffffffc1f6d2c000 0000000000000000 0000000000000000 ffffffc1f6d2ff50
[<ffffffc0000855a8>] el1_irq+0x68/0xd8
[<ffffffc0000e9b48>] default_idle_call+0x1c/0x30
[<ffffffc0000e9d74>] cpu_startup_entry+0x1c8/0x218
[<ffffffc00008e804>] secondary_start_kernel+0x11c/0x140
[<00000041000827ec>] 0x41000827ec
------------[ cut here ]------------
kernel BUG at /home/julien/works/linux/drivers/scsi/scsi_lib.c:1096!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 6 PID: 0 Comm: swapper/6 Tainted: G        W       4.4.0-rc3 #276
Hardware name: APM X-Gene Mustang board (DT)
task: ffffffc1f6d13700 ti: ffffffc1f6d2c000 task.ti: ffffffc1f6d2c000
PC is at scsi_init_sgtable+0xc0/0xd8
LR is at scsi_init_sgtable+0x70/0xd8
pc : [<ffffffc000473b84>] lr : [<ffffffc000473b34>] pstate: 200001c5
sp : ffffffc1f6d2f950
x29: ffffffc1f6d2f950 x28: ffffffc000848aa8 
x27: ffffffc000808270 x26: ffffffc1f5cd8000 
x25: ffffffc1f6e68830 x24: 0000000000034000 
x23: ffffffc1f6e68800 x22: 0000000000000000 
x21: 0000000000000000 x20: ffffffc0fa11e000 
x19: ffffffc0fa25b2c0 x18: 0000000000000007 
x17: 000000000000000e x16: 0000000000000001 
x15: 0000000000000019 x14: 0000000000000033 
x13: 000000000000004c x12: 0000000000000068 
x11: ffffffc1f6d2fbd0 x10: ffffffc1f62e0000 
x9 : 0000000000000000 x8 : ffffffc1f6166740 
x7 : 0000000000000000 x6 : 0000000000000000 
x5 : 0000000000001000 x4 : 0000000000001000 
x3 : 0000000000001000 x2 : 00000042f2e4c000 
x1 : 000000000000000a x0 : 000000000000000b 

Process swapper/6 (pid: 0, stack limit = 0xffffffc1f6d2c020)
Stack: (0xffffffc1f6d2f950 to 0xffffffc1f6d30000)
f940:                                   ffffffc1f6d2f980 ffffffc000473bd4
f960: ffffffc0fa11e000 ffffffc0fa11e000 ffffffc0fa25b200 ffffffc000483838
f980: ffffffc1f6d2f9c0 ffffffc00047c858 ffffffc0fa11e000 ffffffc1f6e68800
f9a0: ffffffc1f62e0000 000000000acdc310 ffffffc1f5cd9400 ffffffc0faa64800
f9c0: ffffffc1f6d2fa30 ffffffc000473d6c ffffffc0fa25b200 ffffffc1f6e68968
f9e0: ffffffc1f62e0000 ffffffc1f6e68800 ffffffc1f62e0000 ffffffc1f6ff6d70
fa00: ffffffc1f6e68830 ffffffc1f6e68800 ffffffc1f6d2fa20 ffffffc00046d408
fa20: ffffffc1f6d2fa60 ffffffc000473ee8 ffffffc1f6d2fa60 ffffffc000473e78
fa40: ffffffc0fa11e000 ffffffc1f6e68800 ffffffc1f62e0000 ffffffc1f6ff6d70
fa60: ffffffc1f6d2fa90 ffffffc00035739c ffffffc1f62e0000 ffffffc0fa11e000
fa80: ffffffc0fa8d9100 0000000000000080 ffffffc1f6d2fac0 ffffffc000474850
faa0: ffffffc1f6e68800 ffffffc0faa64800 ffffffc0fab6ed80 ffffffc1f6e68850
fac0: ffffffc1f6d2fb30 ffffffc000353978 ffffffc1f62e0000 ffffffc1f5cd8028
fae0: ffffffc0faa64840 ffffffc1f62e0000 ffffffc1f5cd8000 0000000000000140
fb00: 0000000000000000 ffffffc1f62e0000 0000000000000005 0000000000001d4c
fb20: ffffffc1f6d2fb30 ffffffc000848b38 ffffffc1f6d2fb50 ffffffc000353b80
fb40: ffffffc1f62e0000 ffffffc0009a2e08 ffffffc1f6d2fb80 ffffffc000472cfc
fb60: ffffffc0faa64800 0000000000000140 0000000000000000 0000000000000140
fb80: ffffffc1f6d2fbe0 ffffffc000473728 ffffffc1f6e68800 0000000000000000
fba0: ffffffc0f8c2e000 ffffffc0fa25b200 ffffffc1f62e0000 0000000000000140
fbc0: 0000000000000000 ffffffc0fa25b200 ffffffc1f62e0000 0000000000000000
fbe0: ffffffc1f6d2fc30 ffffffc000474ed0 ffffffc0fa25b200 ffffffc0f8c2e000
fc00: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
fc20: 0000000000001000 0000000000000006 ffffffc1f6d2fca0 ffffffc00046d910
fc40: ffffffc0fa25b200 0000000000001000 ffffffc1f5cd8028 ffffffc0faa64800
fc60: 0000000000000020 0000000000000101 0000000000000004 ffffffc000966200
fc80: ffffffc000966220 0000000000000000 ffffffc0fa25b200 0000000000002002
fca0: ffffffc1f6d2fcd0 ffffffc0004747d4 ffffffc0fa25b200 0000000000001d4c
fcc0: 0000000000000005 ffffffc1f6d2fd30 ffffffc1f6d2fd00 ffffffc00035d160
fce0: ffffffc1f6d2fd20 ffffffc000966000 ffffffc000946a38 0000000000000000
fd00: ffffffc1f6d2fd30 ffffffc0000b8a30 ffffffc1f6d2c000 ffffffc0000d6a78
fd20: ffffffc1f6d2fd20 ffffffc1f6d2fd20 ffffffc1f6d2fdb0 ffffffc0000b8d84
fd40: ffffffc000948000 0000000000000006 0000000000000000 ffffff8000040010
fd60: ffffff8000041000 ffffffc000677978 ffffffc000966000 ffffffc1f6d2c000
fd80: 0000000000000000 0000000000000000 ffffffc000948000 00000000ffff05a9
fda0: ffffffc00080a998 0000000a00200040 ffffffc1f6d2fdc0 ffffffc00008ec7c
fdc0: ffffffc1f6d2fdf0 ffffffc000082510 ffffff800004000c ffffffc1f6d2fe30
fde0: ffffffc000969000 ffffffc00010f798 ffffffc1f6d2ff50 ffffffc0000855a8
fe00: ffffffc000966000 ffffffc000966a68 ffffffc1f6d2ff50 ffffffc0000867f0
fe20: 0000000060000145 0000000a489e3200 0000000000000000 0000000000000000
fe40: 0000000000000001 ffffffc00096a000 0000000000000001 ffffffc1fff9a048
fe60: ffffffc1f6fbef08 ffffffc1fff9a188 00000000ffff0594 ffffffc1f6d2fec0
fe80: 0000000000000740 ffffffc1f6276370 0000000000000018 00000003e8000000
fea0: 0000000000000000 000a9e23fc000000 ffffffc0001a34d4 0000007f8a8d2820
fec0: 0000007f89432760 ffffffc000966000 ffffffc000966a68 ffffffc000946ac0
fee0: ffffffc1f6d2ff70 ffffffc00094a1e8 ffffffc000677978 ffffffc000966000
ff00: ffffffc1f6d2c000 0000000000000000 0000000000000000 ffffffc1f6d2ff50
ff20: ffffffc0000867ec ffffffc1f6d2ff50 ffffffc0000867f0 0000000060000145
ff40: ffffffc000966000 ffffffc0001126b8 ffffffc1f6d2ff60 ffffffc0000e9b48
ff60: ffffffc1f6d2ff70 ffffffc0000e9d74 ffffffc1f6d2ffd0 ffffffc00008e804
ff80: 0000000000000006 0000000000000e11 ffffffc0009db6a8 0000000000000000
ffa0: 0000000000000000 0000000000000000 0000004100a0f000 0000004100a12000
ffc0: ffffffc000082800 0000000000000000 0000000000000000 00000041000827ec
ffe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
Call trace:
[<ffffffc000473b84>] scsi_init_sgtable+0xc0/0xd8
[<ffffffc000473bd4>] scsi_init_io+0x38/0x108
[<ffffffc00047c858>] sd_init_command+0x44/0x9c4
[<ffffffc000473d6c>] scsi_setup_cmnd+0xc8/0x11c
[<ffffffc000473e78>] scsi_prep_fn+0xb8/0x138
[<ffffffc00035739c>] blk_peek_request+0x150/0x204
[<ffffffc000474850>] scsi_request_fn+0x4c/0x5ac
[<ffffffc000353978>] __blk_run_queue+0x34/0x4c
[<ffffffc000353b80>] blk_run_queue+0x24/0x3c
[<ffffffc000472cfc>] scsi_run_queue+0x204/0x290
[<ffffffc000473728>] scsi_end_request+0x128/0x188
[<ffffffc000474ed0>] scsi_io_completion+0x98/0x514
[<ffffffc00046d910>] scsi_finish_command+0xc4/0x110
[<ffffffc0004747d4>] scsi_softirq_done+0x130/0x160
[<ffffffc00035d160>] blk_done_softirq+0x7c/0x94
[<ffffffc0000b8a30>] __do_softirq+0xfc/0x200
[<ffffffc0000b8d84>] irq_exit+0x84/0xd8
[<ffffffc00008ec7c>] handle_IPI+0x104/0x19c
[<ffffffc000082510>] gic_handle_irq+0x84/0x9c
Exception stack(0xffffffc1f6d2fe00 to 0xffffffc1f6d2ff20)
fe00: ffffffc000966000 ffffffc000966a68 ffffffc1f6d2ff50 ffffffc0000867f0
fe20: 0000000060000145 0000000a489e3200 0000000000000000 0000000000000000
fe40: 0000000000000001 ffffffc00096a000 0000000000000001 ffffffc1fff9a048
fe60: ffffffc1f6fbef08 ffffffc1fff9a188 00000000ffff0594 ffffffc1f6d2fec0
fe80: 0000000000000740 ffffffc1f6276370 0000000000000018 00000003e8000000
fea0: 0000000000000000 000a9e23fc000000 ffffffc0001a34d4 0000007f8a8d2820
fec0: 0000007f89432760 ffffffc000966000 ffffffc000966a68 ffffffc000946ac0
fee0: ffffffc1f6d2ff70 ffffffc00094a1e8 ffffffc000677978 ffffffc000966000
ff00: ffffffc1f6d2c000 0000000000000000 0000000000000000 ffffffc1f6d2ff50
[<ffffffc0000855a8>] el1_irq+0x68/0xd8
[<ffffffc0000e9b48>] default_idle_call+0x1c/0x30
[<ffffffc0000e9d74>] cpu_startup_entry+0x1c8/0x218
[<ffffffc00008e804>] secondary_start_kernel+0x11c/0x140
[<00000041000827ec>] 0x41000827ec
Code: b9000a66 97fc3032 17ffffea d4210000 (d4210000) 
---[ end trace 247f3acfda1a2561 ]---

The bisector fingered the commit 578270b "block: fix segment split".
If I reverted this patch on top of 4.4-rc3 and everything seems to
work fine.

Anyone have any ideas?

FWIW, the 2 patches mentioned in a related thread [1] are already
part of Linux 4.4-rc3.

Regards,

[1] https://lkml.org/lkml/2015/11/18/189

-- 
Julien Grall
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/