External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-22 12:35:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

libxl: Fix race between destruction of objects

Browse Source 
It is possible to destroy and cleanup a VM, resulting in freeing the
libxlDomainObjPrivate object and associated libxl ctx, before all fds and
timeouts have been deregistered and destroyed.

Fix this race by incrementing the reference count on libxlDomainObjPrivate
for each fd and timeout registration.  Only when all fds and timeouts are
deregistered and destroyed will the libxlDomainObjPrivate be destroyed.
This commit is contained in:
Jim Fehlig 2013-01-21 10:22:07 -07:00
parent e0622ca281
commit 889ce7460c
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/libxl/libxl_driver.c
View File

@ -111,7 +111,11 @@ libxlDriverUnlock(libxlDriverPrivatePtr driver)
static void
libxlEventHookInfoFree(void *obj)
{
VIR_FREE(obj);
libxlEventHookInfoPtr info = obj;
/* Drop reference on libxlDomainObjPrivate */
virObjectUnref(info->priv);
VIR_FREE(info);
}
static void
@ -161,6 +165,13 @@ libxlFDRegisterEventHook(void *priv, int fd, void **hndp,
}
info->priv = priv;
/*
* Take a reference on the domain object. Reference is dropped in
* libxlEventHookInfoFree, ensuring the domain object outlives the fd
* event objects.
*/
virObjectRef(info->priv);
info->xl_priv = xl_priv;
*hndp = info;
@ -257,6 +268,13 @@ libxlTimeoutRegisterEventHook(void *priv,
}
info->priv = priv;
/*
* Also take a reference on the domain object. Reference is dropped in
* libxlEventHookInfoFree, ensuring the domain object outlives the timeout
* event objects.
*/
virObjectRef(info->priv);
info->xl_priv = xl_priv;
*hndp = info;