On 24.08.2016 12:55, Roman Bogorodskiy wrote:
Test 12 from objecteventtest (createXML add event) segaults on
FreeBSD
with bus error.
At some point it calls testNodeDeviceDestroy() from the test driver. And
it fails when it tries to unlock the device in the "out:" label of this
function.
Unlocking fails because the previous step was a call to
virNodeDeviceObjRemove from conf/node_device_conf.c. This function
removes the given device from the device list and cleans up the object,
including destroying of its mutex. However, it does not nullify the pointer
that was given to it.
As a result, we end up in testNodeDeviceDestroy() here:
out:
if (obj)
virNodeDeviceObjUnlock(obj);
And instead of skipping this, we try to do Unlock and fail because of
malformed mutex.
Fix this by nullifying obj passed to virNodeDeviceObjRemove.
---
src/conf/node_device_conf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
index a23d8ef..16b9d93 100644
--- a/src/conf/node_device_conf.c
+++ b/src/conf/node_device_conf.c
@@ -218,6 +218,7 @@ void virNodeDeviceObjRemove(virNodeDeviceObjListPtr devs,
if (devs->objs[i] == dev) {
virNodeDeviceObjUnlock(dev);
virNodeDeviceObjFree(devs->objs[i]);
+ *(void**)dev = NULL;
VIR_DELETE_ELEMENT(devs->objs, i, devs->count);
break;
This is very hackish. It only clears first 8 bytes of the struct so next
time somebody tries to access the lock in there it's all zeroes.
Either we should make virNodeDeviceObjRemove() take a double pointer
(and thus set the pointer to NULL properly), or fix every caller of
virNodeDeviceObjRemove().
Michal