Bug#542250: Another backtrace of the same

["Nikita V. Youshchenko" <yoush@cs.msu.su>]

Here is one more backtrace of the same crash.

[ 9199.462928] Call Trace:
[ 9199.462928]  <IRQ>  [<ffffffff80435886>] ? _spin_lock+0x3a/0x42
[ 9199.462928]  [<ffffffffa00964f4>] ? :sata_sil:sil_interrupt+0x2b/0x275
[ 9199.462928]  [<ffffffff8025f0e6>] ? handle_IRQ_event+0x47/0x8e
[ 9199.462928]  [<ffffffff802605a2>] ? handle_level_irq+0xae/0x116
[ 9199.462928]  [<ffffffff8020e13e>] ? do_IRQ+0x4e/0x9a
[ 9199.462928]  [<ffffffff8037d4cc>] ? evtchn_do_upcall+0x13c/0x1fc
[ 9199.462928]  [<ffffffff8020bbde>] ? do_hypervisor_callback+0x1e/0x30
[ 9199.462928]  <EOI>  [<ffffffff802e48d1>] ? dummy_inode_permission+0x0/0x3
[ 9199.462928]  [<ffffffff8037cbf9>] ? xen_poll_irq+0x67/0x74
[ 9199.462928]  [<ffffffff8037fb06>] ? xen_spin_wait+0xfa/0x139
[ 9199.462928]  [<ffffffff80435cfd>] ? lock_kernel+0x4f/0x63
[ 9199.462928]  [<ffffffffa04327b4>] ? :nfs:nfs_permission+0xb0/0x15f
[ 9199.462928]  [<ffffffff80291e65>] ? permission+0xb5/0x118
[ 9199.462928]  [<ffffffff80293469>] ? __link_path_walk+0x145/0xdfa
[ 9199.462928]  [<ffffffffa044020a>] ? :nfs:nfs_sync_mapping_wait+0x151/0x33f
[ 9199.462928]  [<ffffffff80294164>] ? path_walk+0x46/0x8b
[ 9199.462928]  [<ffffffff80294490>] ? do_path_lookup+0x158/0x1ce
[ 9199.462928]  [<ffffffff80294fd3>] ? __path_lookup_intent_open+0x56/0x97
[ 9199.462928]  [<ffffffff80295109>] ? do_filp_open+0x9c/0x7c4
[ 9199.462928]  [<ffffffff802888ff>] ? get_unused_fd_flags+0x74/0x13f
[ 9199.462928]  [<ffffffff80288a10>] ? do_sys_open+0x46/0xc3
[ 9199.462928]  [<ffffffff8020b528>] ? system_call+0x68/0x6d
[ 9199.462928]  [<ffffffff8020b4c0>] ? system_call+0x0/0x6d

What is similar in all instances - it enters
... -> lock_kernel() -> xen_spin_wait() -> xen_poll_irq(),
then gets an interrupt, then enters
... -> :sata_sil:sil_interrupt() -> _spin_lock()
and gets kernel BUG at drivers/xen/core/spinlock.c:74

which is xen_spin_wait():
...
    66          /* announce we're spinning */
    67          spinning = &__get_cpu_var(spinning);
    68          if (spinning->lock) {
    69                  BUG_ON(spinning->lock == lock);
    70                  if(raw_irqs_disabled()) {
    71                          BUG_ON(__get_cpu_var(spinning_bh).lock == lock);
    72                          spinning = &__get_cpu_var(spinning_irq);
    73                  } else {
    74                          BUG_ON(!in_softirq());
    75                          spinning = &__get_cpu_var(spinning_bh);
    76                  }
    77                  BUG_ON(spinning->lock);
    78          }
...

So code thies to take BKL and spins there.
While spinning, interrupt arrives.
Interrupt handler tries to take another lock.
But xen_spin_wait() is not expecting attempt to take another lock when
not raw_irqs_disabled() and not in_softirq().

Here we are in interrupt handler, bit hard irq are not disabled.

Looks like check in line 70 is wrong.

Nikita