[Xen-changelog] [xen-unstable] xen: Fix domain teardown to avoid use-after-free of vcpu structs.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1180962310 -3600
# Node ID c388a2ff1b8e1fba4fe88cd9365e493b715abf25
# Parent  267ccb919967944c1d443af13376b0d3cd3e774c
xen: Fix domain teardown to avoid use-after-free of vcpu structs.
Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
---
 xen/common/domain.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletion(-)

diff -r 267ccb919967 -r c388a2ff1b8e xen/common/domain.c
--- a/xen/common/domain.c       Mon Jun 04 12:47:53 2007 +0100
+++ b/xen/common/domain.c       Mon Jun 04 14:05:10 2007 +0100
@@ -467,7 +467,6 @@ static void complete_domain_destroy(stru
             continue;
         vcpu_destroy(v);
         sched_destroy_vcpu(v);
-        free_vcpu_struct(v);
     }
 
     acm_domain_destroy(d);
@@ -480,6 +479,10 @@ static void complete_domain_destroy(stru
     arch_domain_destroy(d);
 
     sched_destroy_domain(d);
+
+    for ( i = MAX_VIRT_CPUS-1; i >= 0; i-- )
+        if ( (v = d->vcpu[i]) != NULL )
+            free_vcpu_struct(v);
 
     free_domain(d);
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog