[Xen-devel] [PATCH] tmem: fix corner case crash on forcible domain destruction

[Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>]

tmem: fix corner case crash on forcible domain destruction

When a tmem-enabled domain is destroyed, if the domain was
using a persistent pool, the domain destruction process
to scrubs page races tmem's attempts to gracefully dismantle
data structures.  Move tmem_destroy earlier in the domain
destruction process.

Signed-off-by: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>

diff -r fe68405201d2 xen/common/domain.c
--- a/xen/common/domain.c       Wed May 27 15:55:29 2009 +0100
+++ b/xen/common/domain.c       Fri May 29 10:11:36 2009 -0600
@@ -394,6 +394,11 @@ int domain_kill(struct domain *d)
         gnttab_release_mappings(d);
         /* fallthrough */
     case DOMDYING_dying:
+        if ( d->tmem != NULL )
+        {
+            tmem_destroy(d->tmem);
+            d->tmem = NULL;
+        }
         rc = domain_relinquish_resources(d);
         page_scrub_kick();
         if ( rc != 0 )
@@ -572,9 +577,6 @@ static void complete_domain_destroy(stru
     }
 
     grant_table_destroy(d);
-
-    if ( d->tmem != NULL )
-        tmem_destroy(d->tmem);
 
     arch_domain_destroy(d);
 
diff -r fe68405201d2 xen/common/tmem.c
--- a/xen/common/tmem.c Wed May 27 15:55:29 2009 +0100
+++ b/xen/common/tmem.c Fri May 29 10:11:36 2009 -0600
@@ -867,7 +867,6 @@ static void client_free(client_t *client
 {
     list_del(&client->client_list);
     tmh_client_destroy(client->tmh);
-    tmh_set_current_client(NULL);
     tmem_free(client,sizeof(client_t),NULL);
 }

Attachment: tmem-xen-domdes.patch
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel