Michal Privoznik wrote:
On 25.08.2016 07:50, Roman Bogorodskiy wrote:
Test 12 from objecteventtest (createXML add event) segaults on FreeBSD with bus error.
At some point it calls testNodeDeviceDestroy() from the test driver. And it fails when it tries to unlock the device in the "out:" label of this function.
Unlocking fails because the previous step was a call to virNodeDeviceObjRemove from conf/node_device_conf.c. This function removes the given device from the device list and cleans up the object, including destroying of its mutex. However, it does not nullify the pointer that was given to it.
As a result, we end up in testNodeDeviceDestroy() here:
out: if (obj) virNodeDeviceObjUnlock(obj);
And instead of skipping this, we try to do Unlock and fail because of malformed mutex.
Change virNodeDeviceObjRemove to use double pointer and set pointer to NULL. --- src/conf/node_device_conf.c | 13 +++++++------ src/conf/node_device_conf.h | 2 +- src/node_device/node_device_hal.c | 4 ++-- src/test/test_driver.c | 2 +- 4 files changed, 11 insertions(+), 10 deletions(-)
Almost. You've forgotten about udev (perhaps due to BSD? :-P)
Sorry, should have tested this on Linux as well. :( Thanks for catching that!
ACK if you squash this in:
diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c index ddf3d88..520269f 100644 --- a/src/node_device/node_device_udev.c +++ b/src/node_device/node_device_udev.c @@ -1044,7 +1044,7 @@ static int udevRemoveOneDevice(struct udev_device *device)
VIR_DEBUG("Removing device '%s' with sysfs path '%s'", dev->def->name, name); - virNodeDeviceObjRemove(&driver->devs, dev); + virNodeDeviceObjRemove(&driver->devs, &dev);
ret = 0; cleanup:
Safe for freeze.
Pushed with the udev fix squashed in, thanks! Roman Bogorodskiy