Are there any ideas about this crash

last_pfn = 0x42fe0c max_arch_pfn = 0x400000000 BUG: unable to handle kernel paging request at ffffea000e700030 IP: [<ffffffff812352e7>] __list_add+0x6c/0x81 PGD 1a37067 PUD 1a38067 PMD 226f8f067 PTE 0 Oops: 0002 [#1] SMP last sysfs file: CPU 5 Modules linked in: Pid: 1, comm: swapper Tainted: G W 2.6.32.25-171.rc1.xendom0.fc12.x86_64 #1 H8DGT RIP: e030:[<ffffffff812352e7>] [<ffffffff812352e7>] __list_add+0x6c/0x81 RSP: e02b:ffff8803e3491e50 EFLAGS: 00010246 RAX: 000000000e700000 RBX: ffffea000e6ffff0 RCX: 0000000000000a2d RDX: ffffea000e6ffff0 RSI: ffffffff816dc030 RDI: ffffea000e700028 RBP: ffff8803e3491e70 R08: ffffea000e6ffff0 R09: 0000000000000001 R10: 0000000000000008 R11: 00000000e3491d78 R12: ffffffff816dc030 R13: ffffea000e700028 R14: 0000000000000100 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8802270e4000(0000) knlGS:0000000000000000 CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffea000e700030 CR3: 0000000001001000 CR4: 0000000000000660 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 1, threadinfo ffff8803e3490000, task ffff8802170b8000) Stack: 0000000000000100 0000000000420000 ffffea0000000000 000000000042fe0c <0> ffff8803e3491ea0 ffffffff8182ac21 ffffffff8182aa4e ffffffff8182aa4e <0> 0000000000000000 00000000294d99f2 ffff8803e3491ed0 ffffffff8100a069 Call Trace: [<ffffffff8182ac21>] balloon_init+0x1d3/0x213 [<ffffffff8182aa4e>] ? balloon_init+0x0/0x213 [<ffffffff8182aa4e>] ? balloon_init+0x0/0x213 [<ffffffff8100a069>] do_one_initcall+0x5e/0x159 [<ffffffff817fa75f>] kernel_init+0x1fd/0x257 [<ffffffff81013d6a>] child_rip+0xa/0x20 [<ffffffff81012f51>] ? int_ret_from_sys_call+0x7/0x1b [<ffffffff810136dd>] ? retint_restore_args+0x5/0x6 [<ffffffff81013d60>] ? child_rip+0x0/0x20 Code: 04 24 49 39 d8 74 20 4d 89 e1 48 89 d9 48 c7 c2 65 10 60 81 be 1e 00 00 00 48 c7 c7 cd 0f 60 81 31 c0 e8 67 23 e2 ff 4c 89 6b 08 <4d> 89 65 08 49 89 5d 00 4d 89 2c 24 5b 5b 41 5c 41 5d c9 c3 90 RIP [<ffffffff812352e7>] __list_add+0x6c/0x81 RSP <ffff8803e3491e50> CR2: ffffea000e700030 ---[ end trace a7919e7f17c0a726 ]---

The full serial console output is at the provided link. I did some tracing myself and the problem seems to be happening at the list_add call in __balloon_append called from balloon_init in drivers/xen/ballon.c. This is with a kernel I built today (at http://koji.fedoraproject.org/koji/taskinfo?taskID=2550132 ) with the latest stable-2.6.32.x , the 170.1 kernel was built on Thursday (21st Oct) and 170 on 6th October and would have used stable-2.6.32.x at those dates.

Michael Young

---------- Forwarded message ---------- Date: Sat, 23 Oct 2010 14:06:56 -0700 From: fcxen user fcxen@itsbeen.sent.com To: M A Young m.a.young@durham.ac.uk, xen@lists.fedoraproject.org Subject: Re: [Fedora-xen] another xen kernel

170, 170.1, 171 crashed the same

using: title Xen root (hd0,0) kernel /xen.gz loglvl=all guest_loglvl=all sync_console console_to_ring com2=115200,8n1 console=com2,vga lapic=debug apic_verbosity=debug apic=debug iommu=off module /vmlinuz-2.6.32.25-171.rc1.xendom0.fc12.x86_64 ro root=UUID=84e6a109-84c5-4288-80de-ea368a224a3a rd_MD_UUID=c557e3e8:d9ef50b8:b5e9861f:26975533 rd_MD_UUID=5825fd8c:77ea8324:ae0c8804:8a0c2 487 rd_NO_LUKS rd_NO_LVM rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=us console=hvc0 earlyprintk=xen nomodeset initcall_debug debug loglevel=10 module /initramfs-2.6.32.25-171.rc1.xendom0.fc12.x86_64.img

Latest output is: http://pastie.org/1243649