xl list -l aborts with double free error with vlan patches

[Leigh Brown <leigh@xxxxxxxxxxxxx>]

Hello,

When running xl list -l with my VLAN patches applied, a double free 
error is raised. I'm unable to determine why.
broken: 0cc01c603f4287233715a526b056bc20e0e97412 (HEAD) tools/xl: add 
vlan keyword to vif option
okay:   3bc14e4fa4b9832888710759a7dbe5f0d239f33b tools/libs/light: Add 
vlan field to libxl_device_nic
okay:   e27fc7d15eab79e604e8b8728778594accc23cf1 tools/xentop: Fix cpu% 
sort order
Any suggestions appreciated...

Debug run and backtrace:

(gdb) run -vvvv list -l
Starting program: /usr/sbin/xl -vvvv list -l
[Thread debugging using libthread_db enabled]
Using host libthread_db library 
"/lib/x86_64-linux-gnu/libthread_db.so.1".
libxl: debug: libxl_domain.c:2295:libxl_retrieve_domain_configuration: 
ao 0x555555592f50: create: how=(nil) callback=(nil) 
poller=0x55555559dde0
[Detaching after fork from child process 1044]
libxl: debug: libxl_domain.c:2311:libxl_retrieve_domain_configuration: 
ao 0x555555592f50: inprogress: poller=0x55555559dde0, flags=i
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vbd from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vif from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vtpm from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vusb from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vusb from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
pci from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vdispl from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: No 
vsnd from xenstore
libxl: debug: libxl_qmp.c:1920:libxl__ev_qmp_dispose:  ev 0x5555555a0240
libxl: debug: libxl_event.c:2067:libxl__ao_complete: ao 0x555555592f50: 
complete, rc=0
libxl: debug: libxl_event.c:2036:libxl__ao__destroy: ao 0x555555592f50: 
destroy
libxl: debug: libxl_domain.c:2295:libxl_retrieve_domain_configuration: 
Domain 1:ao 0x55555559f830: create: how=(nil) callback=(nil) 
poller=0x55555559dde0
[Detaching after fork from child process 1045]
libxl: debug: libxl_domain.c:2311:libxl_retrieve_domain_configuration: 
Domain 1:ao 0x55555559f830: inprogress: poller=0x55555559dde0, flags=i
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: 
Domain 1:No vtpm from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: 
Domain 1:No vusb from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: 
Domain 1:No vusb from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: 
Domain 1:No pci from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: 
Domain 1:No vdispl from xenstore
libxl: debug: libxl_domain.c:2587:retrieve_domain_configuration_end: 
Domain 1:No vsnd from xenstore
libxl: debug: libxl_qmp.c:1920:libxl__ev_qmp_dispose: Domain 1: ev 
0x5555555a2820
libxl: debug: libxl_event.c:2067:libxl__ao_complete: ao 0x55555559f830: 
complete, rc=0
libxl: debug: libxl_event.c:2036:libxl__ao__destroy: ao 0x55555559f830: 
destroy
free(): double free detected in tcache 2

Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (threadid=<optimized out>, 
signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
44      ./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, 
signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007ffff7d5de8f in __pthread_kill_internal (signo=6, 
threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007ffff7d0efb2 in __GI_raise (sig=sig@entry=6) at 
../sysdeps/posix/raise.c:26
#3  0x00007ffff7cf9472 in __GI_abort () at ./stdlib/abort.c:79
#4  0x00007ffff7d52430 in __libc_message (action=action@entry=do_abort, 
fmt=fmt@entry=0x7ffff7e6c459 "%s\n") at 
../sysdeps/posix/libc_fatal.c:155
#5  0x00007ffff7d677aa in malloc_printerr (str=str@entry=0x7ffff7e6f098 
"free(): double free detected in tcache 2") at ./malloc/malloc.c:5660
#6  0x00007ffff7d69a36 in _int_free (av=0x7ffff7ea5c60 <main_arena>, 
p=0x5555555a0f90, have_lock=have_lock@entry=0) at ./malloc/malloc.c:4469
#7  0x00007ffff7d6be8f in __GI___libc_free (mem=<optimized out>) at 
./malloc/malloc.c:3385
#8  0x00007ffff7f160a3 in libxl__free_all (gc=gc@entry=0x55555559f870) 
at libxl_internal.c:86
#9  0x00007ffff7f27c11 in libxl__ao__destroy (ctx=0x555555591850, 
ao=ao@entry=0x55555559f830) at libxl_event.c:2039
#10 0x00007ffff7f27c3e in ao__check_destroy (ctx=<optimized out>, 
ao=ao@entry=0x55555559f830) at libxl_event.c:2028
#11 0x00007ffff7f27c76 in ao__manip_leave (ctx=<optimized out>, 
ao=ao@entry=0x55555559f830) at libxl_event.c:2021
#12 0x00007ffff7f2948f in libxl__ao_inprogress 
(ao=ao@entry=0x55555559f830, file=file@entry=0x7ffff7f80866 
"libxl_domain.c", line=line@entry=2311,
    func=func@entry=0x7ffff7f814a0 <__func__.3> 
"libxl_retrieve_domain_configuration") at libxl_event.c:2235
#13 0x00007ffff7f46add in libxl_retrieve_domain_configuration 
(ctx=<optimized out>, domid=<optimized out>, 
d_config=d_config@entry=0x7fffffffe510, ao_how=ao_how@entry=0x0)
    at libxl_domain.c:2311
#14 0x00005555555744f2 in list_domains_details 
(info=info@entry=0x5555555aa1e0, nb_domain=2) at xl_info.c:479
#15 0x0000555555575e21 in main_list (argc=<optimized out>, 
argv=<optimized out>) at xl_info.c:582
#16 0x0000555555561b55 in main (argc=2, argv=0x7fffffffecd8) at xl.c:451

Regards,

Leigh.