d8d4aa01d8
Despite the comment stating virNetClientIncomingEvent handler should never be called with either client->haveTheBuck or client->wantClose set, there is a sequence of events that may lead to both booleans being true when virNetClientIncomingEvent is called. However, when that happens, we must not immediately close the socket as there are other threads waiting for the buck and they would cause SIGSEGV once they are woken up after the socket was closed. Another thing is we should clear all remaining calls in the queue after closing the socket. The situation that can lead to the crash involves three threads, one of them running event loop and the other two calling libvirt APIs. The event loop thread detects an event on client->sock and calls virNetClientIncomingEvent handler. But before the handler gets a chance to lock client, the other two threads (T1 and T2) start calling some APIs. T1 gets the buck and detects EOF on client->sock while processing its RPC call. Since T2 is waiting for its own call, T1 passes the buck on to it and unlocks client. But before T2 gets the signal, the event loop thread wakes up, does its job and closes client->sock. The crash happens when T2 actually wakes up and tries to do its job using a closed client->sock.
LibVirt : simple API for virtualization
Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). It is free software
available under the GNU Lesser General Public License. Virtualization of
the Linux Operating System means the ability to run multiple instances of
Operating Systems concurrently on a single hardware system where the basic
resources are driven by a Linux instance. The library aim at providing
long term stable C API initially for the Xen paravirtualization but
should be able to integrate other virtualization mechanisms if needed.
Daniel Veillard <veillard@redhat.com>