Back to bug 1038816

Who When What Removed Added
Michal Privoznik 2013-12-06 07:54:51 UTC Status NEW POST
Jiri Denemark 2013-12-06 10:01:30 UTC Assignee libvirt-maint mprivozn
Michal Privoznik 2013-12-06 12:19:45 UTC Doc Text Cause:
Two threads are working over the same domain. In fact, one is starting it, the other one is trying to destroy it. However, there is a race which can cause a domain to disappear in both threads leaving the start daemon access free()d memory.

Consequence:
The daemon crashes.

Fix:
The critical section was guarded by incrementing the reference counter of the domain. So whenver the domain is destroyed, the startup thread still holds the last reference which gets decremented once the startup process finishes.

Result:
The daemon crashes no more.
Jiri Denemark 2013-12-11 13:59:37 UTC Status POST MODIFIED
Fixed In Version libvirt-0.10.2-29.el6_5.2
errata-xmlrpc 2013-12-11 14:20:10 UTC Status MODIFIED ON_QA
yanbing du 2013-12-12 07:00:25 UTC Status ON_QA VERIFIED
errata-xmlrpc 2013-12-17 16:01:54 UTC Status VERIFIED RELEASE_PENDING
errata-xmlrpc 2013-12-18 09:24:55 UTC Status RELEASE_PENDING CLOSED
Resolution --- ERRATA
Last Closed 2013-12-18 04:24:55 UTC

Back to bug 1038816