[PATCH 2/4] libxl: remove domain when migration prepare fails

[Jim Fehlig <jfehlig@xxxxxxxx>]

In libxlDomainMigrationPrepare(), a new virDomainObj is created
from the incoming domain def and added to the driver's domain
list, but never removed if there are subsequent failures during
the prepare phase.

targethost# virsh list --all

sourcehost# virsh migrate --live dom xen+ssh://targethost/system
   error: operation failed: Fail to create socket for incoming migration.

targethost# virsh list --all
error: Failed to list domains
error: name in virGetDomain must not be NULL

After adding code to remove the domain on prepare failure, noticed
that libvirtd crashed due to double free of the virDomainDef.  Similar
to the qemu driver, pass a pointer to virDomainDefPtr so it can be set
to NULL once a virDomainObj is created from it.

Signed-off-by: Jim Fehlig <jfehlig@xxxxxxxx>
---
 src/libxl/libxl_driver.c    |  2 +-
 src/libxl/libxl_migration.c | 10 ++++++++--
 src/libxl/libxl_migration.h |  2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c
index 9aec78d..b5f8703 100644
--- a/src/libxl/libxl_driver.c
+++ b/src/libxl/libxl_driver.c
@@ -4435,7 +4435,7 @@ libxlDomainMigratePrepare3Params(virConnectPtr dconn,
     if (virDomainMigratePrepare3ParamsEnsureACL(dconn, def) < 0)
         goto error;
 
-    if (libxlDomainMigrationPrepare(dconn, def, uri_in, uri_out, flags) < 0)
+    if (libxlDomainMigrationPrepare(dconn, &def, uri_in, uri_out, flags) < 0)
         goto error;
 
     return 0;
diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c
index cfbbcd0..334aa85 100644
--- a/src/libxl/libxl_migration.c
+++ b/src/libxl/libxl_migration.c
@@ -265,7 +265,7 @@ libxlDomainMigrationPrepareDef(libxlDriverPrivatePtr driver,
 
 int
 libxlDomainMigrationPrepare(virConnectPtr dconn,
-                            virDomainDefPtr def,
+                            virDomainDefPtr *def,
                             const char *uri_in,
                             char **uri_out,
                             unsigned int flags)
@@ -283,12 +283,13 @@ libxlDomainMigrationPrepare(virConnectPtr dconn,
     size_t i;
     int ret = -1;
 
-    if (!(vm = virDomainObjListAdd(driver->domains, def,
+    if (!(vm = virDomainObjListAdd(driver->domains, *def,
                                    driver->xmlopt,
                                    VIR_DOMAIN_OBJ_LIST_ADD_LIVE |
                                    VIR_DOMAIN_OBJ_LIST_ADD_CHECK_LIVE,
                                    NULL)))
         goto error;
+    *def = NULL;
 
     /* Create socket connection to receive migration data */
     if (!uri_in) {
@@ -405,6 +406,11 @@ libxlDomainMigrationPrepare(virConnectPtr dconn,
         virNetSocketClose(socks[i]);
         virObjectUnref(socks[i]);
     }
+    /* Remove virDomainObj from domain list */
+    if (vm) {
+        virDomainObjListRemove(driver->domains, vm);
+        vm = NULL;
+    }
 
  done:
     virURIFree(uri);
diff --git a/src/libxl/libxl_migration.h b/src/libxl/libxl_migration.h
index aab96f5..20b45d8 100644
--- a/src/libxl/libxl_migration.h
+++ b/src/libxl/libxl_migration.h
@@ -50,7 +50,7 @@ libxlDomainMigrationPrepareDef(libxlDriverPrivatePtr driver,
 
 int
 libxlDomainMigrationPrepare(virConnectPtr dconn,
-                            virDomainDefPtr def,
+                            virDomainDefPtr *def,
                             const char *uri_in,
                             char **uri_out,
                             unsigned int flags);
-- 
1.8.4.5

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list