[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] cpupools and locking


  • To: xen-devel@xxxxxxxxxxxxxxxxxxx, Juergen Gross <juergen.gross@xxxxxxxxxxxxxxxxxxx>, Keir Fraser <Keir.Fraser@xxxxxxxxxxxxx>
  • From: George Dunlap <George.Dunlap@xxxxxxxxxxxxx>
  • Date: Tue, 4 May 2010 13:51:30 -0500
  • Cc:
  • Delivery-date: Tue, 04 May 2010 11:52:33 -0700
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:date:x-google-sender-auth:message-id:subject :from:to:content-type; b=tm+YVb1JdRjErc4IPGAdndEhC3HlPeqb1JE27OXvN38eP3UWlO2Y4Jsh9ajJ1T/RUf VR2wzFmYjEJALBKzB0SciXw0vdnxCJ4u4vo52iLXisJSkvTx0JlNU9nXm2yk4YQkQEUa TOIYG1JJ3ituc7MfZAaeWDk7ToRXSzsJ/cCJ8=
  • List-id: Xen developer discussion <xen-devel.lists.xensource.com>

Something seems not quite right about the cpupool locking... in
xen/common/cpupool.c:cpupool_do_domctl(), the cpupool_lock is only
held during the find for several operations.  Doesn't that mean that,
for instance, it's possible for someone to call CPUPOOL_OP_DESTROY,
while someone concurrently calls CPUPOOL_OP_INFO, such that in the
INFO case, the find succeeds, but the structure is shortly thereafter
freed by DESTROY, even though INFO code still has a pointer to it
which may be dereferenced?  I don't see any reference counting... am I
missing something?

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.