{"action":"created","issue":{"url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/65","repository_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows","labels_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/65/comments","events_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/65/events","html_url":"https://github.com/YanVugenfirer/kvm-guest-drivers-windows/issues/65","id":155868736,"number":65,"title":"Possible data structure corruption","user":{"login":"pturschmid","id":9425276,"avatar_url":"https://avatars.githubusercontent.com/u/9425276?v=3","gravatar_id":"","url":"https://api.github.com/users/pturschmid","html_url":"https://github.com/pturschmid","followers_url":"https://api.github.com/users/pturschmid/followers","following_url":"https://api.github.com/users/pturschmid/following{/other_user}","gists_url":"https://api.github.com/users/pturschmid/gists{/gist_id}","starred_url":"https://api.github.com/users/pturschmid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pturschmid/subscriptions","organizations_url":"https://api.github.com/users/pturschmid/orgs","repos_url":"https://api.github.com/users/pturschmid/repos","events_url":"https://api.github.com/users/pturschmid/events{/privacy}","received_events_url":"https://api.github.com/users/pturschmid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-20T01:17:43Z","updated_at":"2016-05-24T18:40:24Z","closed_at":null,"body":"We saw a crash that seems to happen when pausing the NetKvm adapter. We recovered the following 2 stacks from the dump.\r\n\r\n```\r\n00 fffff802`4a6a3c08 fffff802`4903c1c2 nt!KeBugCheckEx \r\n01 fffff802`4a6a3c10 fffff802`49232e4d hal!HalBugCheckSystem+0x7e \r\n02 fffff802`4a6a3c50 fffff802`4903cfa1 nt!WheaReportHwError+0x22d \r\n03 fffff802`4a6a3cb0 fffff802`49256c20 hal!HalHandleNMI+0xfe \r\n04 fffff802`4a6a3ce0 fffff802`491cc7c2 nt!KiProcessNMI+0x150 \r\n05 fffff802`4a6a3d30 fffff802`491cc636 nt!KxNmiInterrupt+0x82 \r\n06 fffff802`4a6a3e70 fffff802`49101d6e nt!KiNmiInterrupt+0x176 \r\n07 fffff802`4a698950 fffff800`57bdd768 nt!KxWaitForSpinLockAndAcquire+0x22 \r\n08 fffff802`4a698980 fffff800`57bde585 netkvm!CNdisList<CNBL,CRawAccess,CNonCountingObject>::ForEachPrepareIf<<lambda_6e3a6aeb098631fcc79aaecc43ea142b>,<lambda_0fb1256e1da6df1a035ab89e05289ff7>,<lambda_2e9bd86eeab3a657911ddcd0e23da5de> >+0x4 \r\n09 fffff802`4a6989c0 fffff800`57bd8061 netkvm!CNBL::ParseBuffers+0xbd \r\n0a fffff802`4a698a70 fffff800`57be351c netkvm!ParaNdis_CleanupContext+0x71 \r\n0b fffff802`4a698aa0 fffff800`55ea8e12 netkvm!ParaNdis6_SendPauseRestart+0x50 \r\n0c fffff802`4a698b00 fffff802`490b2f10 NDIS!ndisInterruptDpc+0x1a3 \r\n0d fffff802`4a698be0 fffff802`490b2257 nt!KiExecuteAllDpcs+0x1b0 \r\n0e fffff802`4a698d30 fffff802`491c63d5 nt!KiRetireDpcList+0xd7\r\n```\r\n\r\n```\r\n00 ffffd001`5abf8fe0 fffff802`49101d32 nt!KxWaitForSpinLockAndAcquire+0x1f \r\n01 ffffd001`5abf9010 fffff800`57bde711 nt!KeAcquireSpinLockRaiseToDpc+0x32 \r\n02 ffffd001`5abf9040 fffff800`57bdeecc netkvm!CNBL::ParseOffloads+0xc5 \r\n03 ffffd001`5abf9070 fffff802`4900ba37 netkvm!CParaNdisTX::SendMapped+0x3c \r\n04 ffffd001`5abf90a0 fffff800`55eade82 hal!HalBuildScatterGatherListV2+0x207 \r\n05 ffffd001`5abf9140 fffff800`57bdf09a NDIS!NdisMAllocateNetBufferSGList+0x1a2 \r\n06 (Inline Function) --------`-------- netkvm!RtlFailFast+0x2 \r\n07 (Inline Function) --------`-------- netkvm!FatalListEntryError+0x2 \r\n08 (Inline Function) --------`-------- netkvm!InsertHeadList+0x10c \r\n09 (Inline Function) --------`-------- netkvm!CNdisList<CNBL,CRawAccess,CNonCountingObject>::Push+0x120 \r\n0a ffffd001`5abf9200 fffff800`57bdda02 netkvm!CParaNdisTX::SendMapped+0x20a \r\n0b (Inline Function) --------`-------- netkvm!CNBL::ParseOffloads::__l39::<lambda_45c6048e0eee80e44000724f00745ebe>::operator()+0x18 \r\n0c ffffd001`5abf9240 fffff800`57bdf58f netkvm!CNBL::ParseCSO<<lambda_07bb9e4d8a255eab68dc9a6db8158716>,<lambda_8edd56c1927263d1d00c45709877ef5c>,<lambda_45c6048e0eee80e44000724f00745ebe> >+0x2a \r\n0d ffffd001`5abf9270 fffff800`57bdf1a5 netkvm!CTXVirtQueue::Create+0x43 \r\n0e ffffd001`5abf92a0 fffff800`57be2dce netkvm!CNB::SetupLSO+0xc1 \r\n```\r\n\r\nI think the cause is that m_SendList uses the CRawAccess strategy and there's a race between Remove_LockLess in RemoveAllNonWaitingNBLs and Push in PushMappedNBL. This causes the FatalListEntryError I believe. Using RemoveHeadList instead of RemoveEntryList may be threadsafe. Otherwise I was thinking the m_SendList may need a new barrier to prevent adding new entries when pausing the adapter."},"comment":{"url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/comments/221364484","html_url":"https://github.com/YanVugenfirer/kvm-guest-drivers-windows/issues/65#issuecomment-221364484","issue_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/65","id":221364484,"user":{"login":"pturschmid","id":9425276,"avatar_url":"https://avatars.githubusercontent.com/u/9425276?v=3","gravatar_id":"","url":"https://api.github.com/users/pturschmid","html_url":"https://github.com/pturschmid","followers_url":"https://api.github.com/users/pturschmid/followers","following_url":"https://api.github.com/users/pturschmid/following{/other_user}","gists_url":"https://api.github.com/users/pturschmid/gists{/gist_id}","starred_url":"https://api.github.com/users/pturschmid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pturschmid/subscriptions","organizations_url":"https://api.github.com/users/pturschmid/orgs","repos_url":"https://api.github.com/users/pturschmid/repos","events_url":"https://api.github.com/users/pturschmid/events{/privacy}","received_events_url":"https://api.github.com/users/pturschmid/received_events","type":"User","site_admin":false},"created_at":"2016-05-24T18:40:24Z","updated_at":"2016-05-24T18:40:24Z","body":"By any chance do you have an estimate of when you'll rework the pause behavior? Alternately can you provide a description of what the fix may look like? I want to try a fix ahead of time if possible to see if it makes our repro go away. :-) Thanks!"}}
{"actor":{"display_login":"pturschmid"}}