Fully virtualized Xen DomainU crashes upon incoming network traffic

SUSE Linux Enterprise Server 10 Service Pack 2

If a fully virtualized DomainU (DomU) has 4 GB or more of RAM and is using the paravirtual network drivers contained in the xen-kmp package shipping in SUSE Linux Enterprise Server 10 Service Pack 2 (SLES 10 SP2), some types of network traffic may cause a kernel oops like the one listed in the Additional information section. Simply pinging the DomU will make it crash.

This has been observed with SUSE Linux Enterprise Server 10 Service Pack 2 (SLES 10 SP2) DomU running on SLES 10 SP2 as well as SLES 11 Domain0 servers - all is x86_64 architecture. While only IPv4 traffic has been tested, the problem is also expected to exist with IPv6.

Please note that the problem does not occur, if the emulated network drivers are used, regardless of amount of RAM assigned to the DomU.

The cause of this is a bug in the Linux kernel, where network buffers get corrupted.
SUSE has backported a patch for the SLES 10 SP2 x86_64 kernel that fixes this problem. It is included in kernel maintenance update 2.6.16.60-0.39.3 for SLE 10 SP2, released in June 2009. It will also be included in SLE 10 Service Pack 3, for reference the bug number is 496789.

Example of an oops message :
general protection fault: 0000 [1] SMP
last sysfs file: /devices/pci0000:00/0000:00:00.0/irq
CPU 1
Modules linked in: nfs lockd nfs_acl sunrpc ipv6 dock button battery ac apparmor loop dm_mod i2c_piix4 i2c_core parport_pc lp parport reiserfs edd xen_vnif xen_balloon xen_vbd xen_platform_pci fan thermal processor piix ide_disk ide_core
Pid: 0, comm: swapper Tainted: G U 2.6.16.60-0.38_f594963d-smp #1
RIP: 0010:[<ffffffff802cd5b2>]<ffffffff802cd5b2>{icmp_echo+78}
RSP: 0018:ffff81010b887d00 EFLAGS: 00010296
RAX: ffff81010b881fd8 RBX: ffff81010ad41d80 RCX: ffff81010b887cc0
RDX: ffff810080c05100 RSI: ffff81010bd3b0c0 RDI: ffff81010b1516c0
RBP: ffff810108a22b40 R08: 0000000000000001 R09: ffff81010bd3b0c0
R10: 000000002a3ba239 R11: 00000000412c19cd R12: 0000000000000000
R13: ffff81010c470008 R14: 0000000000000f01 R15: ffff81010975d180
FS: 0000000000000000(0000) GS:ffff81010c43b6c0(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00002b8780d0a1b0 CR3: 000000010ad59000 CR4: 00000000000006e0
Process swapper (pid: 0, threadinfo ffff81010b880000, task ffff81010b8760c0)
Stack: 76c3600000000000 0000000000000000 6669d00000000000 76c3b00000000000
81bbb00000000000 0000010000000000 0000000000000000 0000000000000000
0000000000000000 ea01000000000000
Call Trace: <IRQ> <ffffffff8012d69d>{__wake_up+56}<ffffffff8028dfad>{net_rx_action+165}
<ffffffff80139780>{__do_softirq+85}<ffffffff8010c19a>{call_softirq+30}
<ffffffff8010d11c>{do_softirq+44}<ffffffff8010d4e6>{do_IRQ+64}
<ffffffff80109d41>{default_idle+0}<ffffffff8010b2d6>{ret_from_intr+0} <EOI>
<ffffffff80109d41>{default_idle+0}<ffffffff80109d7d>{default_idle+60}
<ffffffff80109e57>{cpu_idle+160}<ffffffff8011961e>{start_secondary+1279}

Code: c3 53 48 89 fb 83 bf 88 00 00 00 13 76 71 8b 87 88 00 00 00
RIP <ffffffff802cd5b2>{icmp_echo+78} RSP<ffff81010b887d00>
<0>Kernel panic - not syncing: Aiee, killing interrupt handler!