[PATCH] Use virDomainFindbyID and pass id instead of a pointer to lxcMontitorEvent.

[Thomas Hunger <tehunger@xxxxxxxxxxxxxx>]

This fixes a race condition when VIR_EVENT_HANDLE_HANGUP is triggered
during lxcDomainDestroyFlags: lxcMonitorEvent tries to acquire the
driver lock held by lxcDomainDestroyFlags and blocks. Meanwhile
lxcDomainDestroyFlags will free the "vm" structure and release the driver
lock. lxcMonitorEvent unblocks and operates on an invalid "vm" pointer.

By using virDomainFindbyID lxcMonitorEvent avoids using an invalid vm
pointer.
---
 src/lxc/lxc_driver.c |   13 +++++++++----
 1 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index 3af8084..c55e164 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -1523,12 +1523,17 @@ static void lxcMonitorEvent(int watch,
                             void *data)
 {
     lxc_driver_t *driver = lxc_driver;
-    virDomainObjPtr vm = data;
+    int id = (int)data;
+    virDomainObjPtr vm = NULL;
     virDomainEventPtr event = NULL;
     lxcDomainObjPrivatePtr priv;
 
     lxcDriverLock(driver);
-    virDomainObjLock(vm);
+    vm = virDomainFindByID(&driver->domains, id);
+    if (vm == NULL) {
+        lxcDriverUnlock(driver);
+        goto cleanup;
+    }
     lxcDriverUnlock(driver);
 
     priv = vm->privateData;
@@ -1950,7 +1955,7 @@ static int lxcVmStart(virConnectPtr conn,
              priv->monitor,
              VIR_EVENT_HANDLE_ERROR | VIR_EVENT_HANDLE_HANGUP,
              lxcMonitorEvent,
-             vm, NULL)) < 0) {
+             (void*)vm->def->id, NULL)) < 0) {
         goto error;
     }
 
@@ -2513,7 +2518,7 @@ lxcReconnectVM(void *payload, const void *name ATTRIBUTE_UNUSED, void *opaque)
                  priv->monitor,
                  VIR_EVENT_HANDLE_ERROR | VIR_EVENT_HANDLE_HANGUP,
                  lxcMonitorEvent,
-                 vm, NULL)) < 0)
+                 (void*)vm->def->id, NULL)) < 0)
             goto error;
 
         if (virSecurityManagerReserveLabel(driver->securityManager,
-- 
1.7.2.5

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list