[Xen-changelog] [xen-unstable] tmem: Fix another race in tmem on domain destroy.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1259073479 0
# Node ID adeddc2dd1c67a0e0eee9951f7820766bbd550b4
# Parent  d62bede476cb3dbcdc3b35884ea4a404d52f1dc5
tmem: Fix another race in tmem on domain destroy.

Signed-off-by: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>
---
 xen/common/tmem.c |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletion(-)

diff -r d62bede476cb -r adeddc2dd1c6 xen/common/tmem.c
--- a/xen/common/tmem.c Mon Nov 23 15:19:38 2009 +0000
+++ b/xen/common/tmem.c Tue Nov 24 14:37:59 2009 +0000
@@ -149,6 +149,7 @@ struct tm_pool {
 struct tm_pool {
     bool_t shared;
     bool_t persistent;
+    bool_t is_dying;
     int pageshift; /* 0 == 2**12 */
     struct list_head pool_list; /* FIXME do we need this anymore? */
     client_t *client;
@@ -724,6 +725,7 @@ static void pool_destroy_objs(pool_t *po
     int i;
 
     tmem_write_lock(&pool->pool_rwlock);
+    pool->is_dying = 1;
     for (i = 0; i < OBJ_HASH_BUCKETS; i++)
     {
         node = rb_first(&pool->obj_rb_root[i]);
@@ -734,7 +736,8 @@ static void pool_destroy_objs(pool_t *po
             node = rb_next(node);
             ASSERT(obj->no_evict == 0);
             if ( !selective )
-                obj_destroy(obj,1);
+                /* FIXME: should be obj,1 but walking/erasing rbtree is racy */
+                obj_destroy(obj,0);
             else if ( obj->last_client == cli_id )
                 obj_destroy(obj,0);
             else
@@ -770,6 +773,7 @@ static pool_t * pool_alloc(void)
     pool->found_gets = pool->gets = 0;
     pool->flushs_found = pool->flushs = 0;
     pool->flush_objs_found = pool->flush_objs = 0;
+    pool->is_dying = 0;
     SET_SENTINEL(pool,POOL);
     return pool;
 }
@@ -1001,6 +1005,8 @@ static int tmem_evict(void)
         {
             obj = pgp->obj;
             pool = obj->pool;
+            if ( pool->is_dying )
+                continue;
             if ( tmh_lock_all && !obj->no_evict )
                 goto found;
             if ( tmem_spin_trylock(&obj->obj_spinlock) )
@@ -1022,6 +1028,8 @@ static int tmem_evict(void)
         {
             obj = pgp->obj;
             pool = obj->pool;
+            if ( pool->is_dying )
+                continue;
             if ( tmh_lock_all && !obj->no_evict )
                 goto found;
             if ( tmem_spin_trylock(&obj->obj_spinlock) )

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog