Bug 619268
| Summary: | rmmod kvm modules cause host kernel panic | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Suqin Huang <shuang> |
| Component: | kvm | Assignee: | Eduardo Habkost <ehabkost> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 5.6 | CC: | akong, llim, mkenneth, tburke, virt-maint, ykaul |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kvm-83-199.el5 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-01-13 23:37:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 580949 | ||
|
Description
Suqin Huang
2010-07-29 06:22:16 UTC
Found the likely cause: the problem is that debugfs_remove() is called when kvm-intel (or kvm-amd) is unloaded, but the .owner field of the debugfs fops structs point to the kvm.ko module. This way, we may end up calling debugfs_remove() while the KVM debugfs files are still open, and that shouldn't be allowed to happen. After some analysis, I concluded that the wrong .owner field may be a problem after the file is already open but the crash here is before fops_get() returns inside __dentry_open(). The main issue seems to be a potential race on __dentry_open(). I will ask for feedback on rhkernel-list as I am not sure I didn't miss anything when reading the sys_open() and module unload codepath. Rewording BZ summary to make it explicit that a module unload is necessary to reproduce it (making it less serious). Even without the potential race condition on __dentry_open(), the crash may be reproduced more easily without any complex race condition, by just doing this on an Intel machine: modprobe kvm modprobe kvm-amd rmmod kvm cat /sys/kernel/debug/kvm/largepages Maybe there is a race condition too, but the more easy-to-reproduce case doesn't involve a race condition, just failure to clean up after errors on kvm_init(). @Suqin Huang: are you able to reproduce this only using "modprobe kvm-amd" on Intel machines (or vice-versa), or it is reproducible also when you are loading the right module? (kvm-intel on Intel machine or kvm-amd on AMD machine) could not rmmod kvm_intel module on AMD machine. it reproduce when I load/unload right module. try 500 times fixed on kvm-83-207.el5 kernel: 2.6.18-230.el5 This bug was reproduced with 2.6.18-194.30.1.el5 + kvm-83-164.el5_5.30, do we need clone it to 5.5.z ? An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-0028.html |