From patchwork Thu May 11 10:55:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Roger_Pau_Monn=C3=A9?= X-Patchwork-Id: 9721187 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 83A626031B for ; Thu, 11 May 2017 10:58:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 819B62865C for ; Thu, 11 May 2017 10:58:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 759E528660; Thu, 11 May 2017 10:58:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 61A502865D for ; Thu, 11 May 2017 10:58:07 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8llC-0004v7-A5; Thu, 11 May 2017 10:55:54 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8llA-0004ue-OA for xen-devel@lists.xenproject.org; Thu, 11 May 2017 10:55:52 +0000 Received: from [193.109.254.147] by server-9.bemta-6.messagelabs.com id 21/6C-03557-83344195; Thu, 11 May 2017 10:55:52 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprDIsWRWlGSWpSXmKPExsXitHRDpK65s0i kwdHV0hbft0xmcmD0OPzhCksAYxRrZl5SfkUCa8aEzj1MBe+kKl7P+87YwHhEpIuRk0NCwF9i 19tT7CA2m4COxMW5O9m6GDk4RARUJG7vNehi5OJgFpjJKPG7v5UFpEZYwEOiefo8MJtFQFVi9 p67zCA2r4ClxKknv5khZupJvJ34ghHE5hSwknjy9CETyEwhoJrtXSYQ5YISJ2c+ARvDLKAp0b r9NzuELS/RvHU22BghAUWJ/nkP2CYw8s1C0jILScssJC0LGJlXMWoUpxaVpRbpGhnoJRVlpme U5CZm5ugaGpjp5aYWFyemp+YkJhXrJefnbmIEhhoDEOxg/LUs4BCjJAeTkihv+x/hSCG+pPyU yozE4oz4otKc1OJDjDIcHEoSvOxOIpFCgkWp6akVaZk5wKCHSUtw8CiJ8JqBpHmLCxJzizPTI VKnGBWlxHl1QBICIImM0jy4NlikXWKUlRLmZQQ6RIinILUoN7MEVf4VozgHo5Iw739HoCk8mX klcNNfAS1mAlrcD3Izb3FJIkJKqoGxTPH6jgVuq3ivn24Lc/7/aGGBCGdCxubjPzg/xhn+u9d 75G5zf254XuEEE0lzvsmsLCeSG38tsWW7Jei5uOvZIeOpE2QzX2wINHLeKHls4l6msHsdMudu Ghz6MO9gP7tIj+0GHf2EtHU2dhtbn4gnPXUK+WnG+4fx6ASz+HOrbyoHpMQXLnyjxFKckWiox VxUnAgAEmWq7K8CAAA= X-Env-Sender: prvs=29737f781=roger.pau@citrix.com X-Msg-Ref: server-8.tower-27.messagelabs.com!1494500150!91293408!1 X-Originating-IP: [66.165.176.89] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni44OSA9PiAyMDMwMDc=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.4.12; banners=-,-,- X-VirusChecked: Checked Received: (qmail 42036 invoked from network); 11 May 2017 10:55:51 -0000 Received: from smtp.citrix.com (HELO SMTP.CITRIX.COM) (66.165.176.89) by server-8.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 11 May 2017 10:55:51 -0000 X-IronPort-AV: E=Sophos;i="5.38,324,1491264000"; d="scan'208";a="423193745" From: Roger Pau Monne To: Date: Thu, 11 May 2017 11:55:44 +0100 Message-ID: <20170511105544.35197-3-roger.pau@citrix.com> X-Mailer: git-send-email 2.11.0 (Apple Git-81) In-Reply-To: <20170511105544.35197-1-roger.pau@citrix.com> References: <20170511105544.35197-1-roger.pau@citrix.com> MIME-Version: 1.0 Cc: Wei Liu , Julien Grall , Ian Jackson , Roger Pau Monne Subject: [Xen-devel] [PATCH v2 2/2] libxl/devd: correctly manipulate the dguest list X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Current code in backend_watch_callback has two issues when manipulating the dguest list: 1. backend_watch_callback forgets to remove a libxl__ddomain_guest from the list of tracked domains when the related data is freed, causing dereferences later on when the list is traversed. Make sure that a domain is always removed from the list when freed. 2. A spurious device state change can cause a dguest to be freed, with active devices and without being removed from the list. Fix this by always checking if a dguest has active devices before freeing and removing it. Let me know if you want me to resend the patch or if you will fix the message while committing. Signed-off-by: Roger Pau Monné Reported-by: Reinis Martinsons Suggested-by: Ian Jackson Reviewed-by: Wei Liu --- Cc: Ian Jackson Cc: Wei Liu Cc: Julien Grall Changes since v1: - Fix commit message --- tools/libxl/libxl_device.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/tools/libxl/libxl_device.c b/tools/libxl/libxl_device.c index cd4ad05a6f..8417198081 100644 --- a/tools/libxl/libxl_device.c +++ b/tools/libxl/libxl_device.c @@ -1602,7 +1602,7 @@ static void backend_watch_callback(libxl__egc *egc, libxl__ev_xswatch *watch, STATE_AO_GC(nested_ao); char *p, *path; const char *sstate, *sonline; - int state, online, rc, num_devs; + int state, online, rc; libxl__device *dev; libxl__ddomain_device *ddev = NULL; libxl__ddomain_guest *dguest = NULL; @@ -1684,21 +1684,9 @@ static void backend_watch_callback(libxl__egc *egc, libxl__ev_xswatch *watch, path); rc = remove_device(egc, nested_ao, dguest, ddev); if (rc > 0) - free_ao = true; + libxl__nested_ao_free(nested_ao); - free(ddev->dev); - free(ddev); - /* If this was the last device in the domain, remove it from the list */ - num_devs = dguest->num_vifs + dguest->num_vbds + dguest->num_qdisks; - if (num_devs == 0) { - LIBXL_SLIST_REMOVE(&ddomain->guests, dguest, libxl__ddomain_guest, - next); - LOGD(DEBUG, dguest->domid, "Removed domain from the list of active guests"); - /* Clear any leftovers in libxl/ */ - libxl__xs_rm_checked(gc, XBT_NULL, - GCSPRINTF("libxl/%u", dguest->domid)); - free(dguest); - } + goto clean; } if (free_ao) @@ -1708,10 +1696,20 @@ static void backend_watch_callback(libxl__egc *egc, libxl__ev_xswatch *watch, skip: libxl__nested_ao_free(nested_ao); +clean: if (ddev) free(ddev->dev); free(ddev); - free(dguest); + if (dguest != NULL && + dguest->num_vifs + dguest->num_vbds + dguest->num_qdisks == 0) { + LIBXL_SLIST_REMOVE(&ddomain->guests, dguest, libxl__ddomain_guest, + next); + LOGD(DEBUG, dguest->domid, "Removed domain from the list of active guests"); + /* Clear any leftovers in libxl/ */ + libxl__xs_rm_checked(gc, XBT_NULL, + GCSPRINTF("libxl/%u", dguest->domid)); + free(dguest); + } return; }