[Xen-devel] cpupools and locking

[George Dunlap <George.Dunlap@xxxxxxxxxxxxx>]

Something seems not quite right about the cpupool locking... in
xen/common/cpupool.c:cpupool_do_domctl(), the cpupool_lock is only
held during the find for several operations.  Doesn't that mean that,
for instance, it's possible for someone to call CPUPOOL_OP_DESTROY,
while someone concurrently calls CPUPOOL_OP_INFO, such that in the
INFO case, the find succeeds, but the structure is shortly thereafter
freed by DESTROY, even though INFO code still has a pointer to it
which may be dereferenced?  I don't see any reference counting... am I
missing something?

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel