[Xen-devel] Re: Xen crash in poll_timer_fn

[Keir Fraser <keir.fraser@xxxxxxxxxxxxx>]

On 24/12/2009 11:31, "Cui, Dexuan" <dexuan.cui@xxxxxxxxx> wrote:

> Hi, I occasionally meet with xen crash when the PV guest shuts down.
> BTW, I'm using xen c/s 20702.
> Per the log, the reason is: v->domain->poll_mask is NULL in poll_timer_fn().
> 
> The poll_mask is freed and set to NULL in domain_kill() -> evtchn_destroy(),
> but the poll_timer may keep active until complete_domain_destroy() ->
> sched_destroy_vcpu() -> kill_timer(). Between them, the timer may be fired and
> poll_timer_fn() would access the NULL pointer and cause the crash.
> 
> Maybe here we should move kill_timer() a little earlier, or free the poll_mask
> a little later?

Easiest just to free the mask later. Should be fixed by c/s 20722.

 Thanks,
 Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel