WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

[Xen-devel] [PATCH] tmem: fix corner case crash on forcible domain destr

To: "Xen-Devel (E-mail)" <xen-devel@xxxxxxxxxxxxxxxxxxx>
Subject: [Xen-devel] [PATCH] tmem: fix corner case crash on forcible domain destruction
From: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>
Date: Fri, 29 May 2009 09:22:16 -0700 (PDT)
Delivery-date: Fri, 29 May 2009 09:22:57 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
tmem: fix corner case crash on forcible domain destruction

When a tmem-enabled domain is destroyed, if the domain was
using a persistent pool, the domain destruction process
to scrubs page races tmem's attempts to gracefully dismantle
data structures.  Move tmem_destroy earlier in the domain
destruction process.

Signed-off-by: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>

diff -r fe68405201d2 xen/common/domain.c
--- a/xen/common/domain.c       Wed May 27 15:55:29 2009 +0100
+++ b/xen/common/domain.c       Fri May 29 10:11:36 2009 -0600
@@ -394,6 +394,11 @@ int domain_kill(struct domain *d)
         gnttab_release_mappings(d);
         /* fallthrough */
     case DOMDYING_dying:
+        if ( d->tmem != NULL )
+        {
+            tmem_destroy(d->tmem);
+            d->tmem = NULL;
+        }
         rc = domain_relinquish_resources(d);
         page_scrub_kick();
         if ( rc != 0 )
@@ -572,9 +577,6 @@ static void complete_domain_destroy(stru
     }
 
     grant_table_destroy(d);
-
-    if ( d->tmem != NULL )
-        tmem_destroy(d->tmem);
 
     arch_domain_destroy(d);
 
diff -r fe68405201d2 xen/common/tmem.c
--- a/xen/common/tmem.c Wed May 27 15:55:29 2009 +0100
+++ b/xen/common/tmem.c Fri May 29 10:11:36 2009 -0600
@@ -867,7 +867,6 @@ static void client_free(client_t *client
 {
     list_del(&client->client_list);
     tmh_client_destroy(client->tmh);
-    tmh_set_current_client(NULL);
     tmem_free(client,sizeof(client_t),NULL);
 }

Attachment: tmem-xen-domdes.patch
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-devel] [PATCH] tmem: fix corner case crash on forcible domain destruction, Dan Magenheimer <=