This patch fixes some flawed logic around ref counting the libxlMigrationDstArgs object. First, when adding sockets to the event loop with virNetSocketAddIOCallback(), the generic virObjectFreeCallback() was registered as a free function, with libxlMigrationDstArgs as its parameter. A reference was also taken on libxlMigrationDstArgs for each successful call to virNetSocketAddIOCallback(). The rational behind this logic was that the libxlMigrationDstArgs object had to out-live the socket objects. But virNetSocketAddIOCallback() already takes a reference on socket objects, ensuring their life until removed from the event loop and unref'ed in virNetSocketEventFree(). We only need to ensure libxlMigrationDstArgs lives until libxlDoMigrateReceive() finishes, which can be done by simply unref'ing libxlMigrationDstArgs at the end of libxlDoMigrateReceive(). The second flaw was unref'ing the sockets in the failure path of libxlMigrateReceive() and at the end of libxlDoMigrateReceive(). As mentioned above, the sockets are already unref'ed by virNetSocketEventFree() when removed from the event loop. Attempting to unref the socket a second time resulted in a libvirtd crash since the socket was previously unref'ed and disposed. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com&gt; --- src/libxl/libxl_migration.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c index aa9547b..4349f02 100644 --- a/src/libxl/libxl_migration.c +++ b/src/libxl/libxl_migration.c @@ -112,11 +112,11 @@ libxlDoMigrateReceive(void *opaque) virNetSocketUpdateIOCallback(socks[i], 0); virNetSocketRemoveIOCallback(socks[i]); virNetSocketClose(socks[i]); - virObjectUnref(socks[i]); socks[i] = NULL; } args->nsocks = 0; VIR_FORCE_CLOSE(recvfd); + virObjectUnref(args); } @@ -164,11 +164,11 @@ libxlMigrateReceive(virNetSocketPtr sock, virNetSocketUpdateIOCallback(socks[i], 0); virNetSocketRemoveIOCallback(socks[i]); virNetSocketClose(socks[i]); - virObjectUnref(socks[i]); socks[i] = NULL; } args->nsocks = 0; VIR_FORCE_CLOSE(recvfd); + virObjectUnref(args); } static int @@ -420,22 +420,12 @@ libxlDomainMigrationPrepare(virConnectPtr dconn, VIR_EVENT_HANDLE_READABLE, libxlMigrateReceive, args, - virObjectFreeCallback) < 0) + NULL) < 0) continue; - /* - * Successfully added sock to event loop. Take a ref on args to - * ensure it is not freed until sock is removed from the event loop. - * Ref is dropped in virObjectFreeCallback after being removed - * from the event loop. - */ - virObjectRef(args); nsocks_listen++; } - /* Done with args in this function, drop reference */ - virObjectUnref(args); - if (!nsocks_listen) goto error; @@ -448,6 +438,8 @@ libxlDomainMigrationPrepare(virConnectPtr dconn, virObjectUnref(socks[i]); } VIR_FREE(socks); + virObjectUnref(args); + /* Remove virDomainObj from domain list */ if (vm) { virDomainObjListRemove(driver->domains, vm); -- 2.1.4

On 07/20/2015 09:28 AM, Olaf Hering wrote: Opps. I've squashed in the below obvious fix. Note it is safe to call virObjectUnref with a NULL object. Any other comments on this series? It fixes bugs in migration, including a possible libvirtd crash, and would be a candidate to push during freeze IMO. Regards, Jim

Failure of libxl_domain_suspend() does not leave the domain in a suspended state, so no need to call libxl_domain_resume(), which btw will fail with "domain not suspended". Signed-off-by: Jim Fehlig <jfehlig(a)suse.com&gt; --- AFAICT, the xl migration code does not call libxl_domain_resume() when libxl_domain_suspend() fails either. Perhaps one of the Xen tools maintainers can verify if calling libxl_domain_resume() is unnecessary when libxl_domain_suspend() fails. src/libxl/libxl_migration.c | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c index 4349f02..2ac4869 100644 --- a/src/libxl/libxl_migration.c +++ b/src/libxl/libxl_migration.c @@ -178,7 +178,6 @@ libxlDoMigrateSend(libxlDriverPrivatePtr driver, int sockfd) { libxlDriverConfigPtr cfg = libxlDriverConfigGet(driver); - virObjectEventPtr event = NULL; int xl_flags = 0; int ret; @@ -188,24 +187,11 @@ libxlDoMigrateSend(libxlDriverPrivatePtr driver, ret = libxl_domain_suspend(cfg->ctx, vm->def->id, sockfd, xl_flags, NULL); if (ret != 0) { - /* attempt to resume the domain on failure */ - if (libxl_domain_resume(cfg->ctx, vm->def->id, 1, 0) != 0) { - VIR_DEBUG("Failed to resume domain following failed migration"); - virDomainObjSetState(vm, VIR_DOMAIN_PAUSED, - VIR_DOMAIN_PAUSED_MIGRATION); - event = virDomainEventLifecycleNewFromObj(vm, VIR_DOMAIN_EVENT_SUSPENDED, - VIR_DOMAIN_EVENT_SUSPENDED_MIGRATED); - ignore_value(virDomainSaveStatus(driver->xmlopt, cfg->stateDir, vm)); - } virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to send migration data to destination host")); ret = -1; - goto cleanup; } - cleanup: - if (event) - libxlDomainEventQueue(driver, event); virObjectUnref(cfg); return ret; } -- 2.1.4