[Xen-devel] [XENSTORED] Fix xenstored abort when connection dropped.

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

[XENSTORED] Fix xenstored abort when connection dropped.

If a connection is dropped with pending input and output data then the
connection will be dereferenced by both handle_input and handle_output
resulting in a double free when the main loop dereferences the
connection.

Fix this issue by taking/releasing a reference over the calls to
handle_input and handle_output separately and checking the result of
talloc_free to see if the connection went away.
ï
Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>

The attached t.c will show you the crash in a few seconds at most
        # gcc ~/t.c
        # while ./a.out  ; do : ; done
        main: Connection refused
        Aborted

Ian.

Attachment: xenstore-abort.patch
Description: Text Data

Attachment: t.c
Description: Text Data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel