libxl: remove domain when migration prepare fails

In libxlDomainMigrationPrepare(), a new virDomainObj is created
from the incoming domain def and added to the driver's domain
list, but never removed if there are subsequent failures during
the prepare phase.

targethost# virsh list --all

sourcehost# virsh migrate --live dom xen+ssh://targethost/system
   error: operation failed: Fail to create socket for incoming migration.

targethost# virsh list --all
error: Failed to list domains
error: name in virGetDomain must not be NULL

After adding code to remove the domain on prepare failure, noticed
that libvirtd crashed due to double free of the virDomainDef.  Similar
to the qemu driver, pass a pointer to virDomainDefPtr so it can be set
to NULL once a virDomainObj is created from it.

diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c
index 9aec78d0c5a239b0c7b5a112df223a14e8a6a589..b5f8703574ca7194f8c73040ca40a1824f01a0b4 100644 (file)
--- a/src/libxl/libxl_driver.c
+++ b/src/libxl/libxl_driver.c
@@ -4435,7 +4435,7 @@ libxlDomainMigratePrepare3Params(virConnectPtr dconn,
     if (virDomainMigratePrepare3ParamsEnsureACL(dconn, def) < 0)
         goto error;
 
-    if (libxlDomainMigrationPrepare(dconn, def, uri_in, uri_out, flags) < 0)
+    if (libxlDomainMigrationPrepare(dconn, &def, uri_in, uri_out, flags) < 0)
         goto error;
 
     return 0;

diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c
index cfbbcd002ac34a2af08a8f841f39adcbc6b78986..334aa85a86cd342c60c4cdc284caf7756fd3d9d9 100644 (file)
--- a/src/libxl/libxl_migration.c
+++ b/src/libxl/libxl_migration.c
@@ -265,7 +265,7 @@ libxlDomainMigrationPrepareDef(libxlDriverPrivatePtr driver,
 
 int
 libxlDomainMigrationPrepare(virConnectPtr dconn,
-                            virDomainDefPtr def,
+                            virDomainDefPtr *def,
                             const char *uri_in,
                             char **uri_out,
                             unsigned int flags)
@@ -283,12 +283,13 @@ libxlDomainMigrationPrepare(virConnectPtr dconn,
     size_t i;
     int ret = -1;
 
-    if (!(vm = virDomainObjListAdd(driver->domains, def,
+    if (!(vm = virDomainObjListAdd(driver->domains, *def,
                                    driver->xmlopt,
                                    VIR_DOMAIN_OBJ_LIST_ADD_LIVE |
                                    VIR_DOMAIN_OBJ_LIST_ADD_CHECK_LIVE,
                                    NULL)))
         goto error;
+    *def = NULL;
 
     /* Create socket connection to receive migration data */
     if (!uri_in) {
@@ -405,6 +406,11 @@ libxlDomainMigrationPrepare(virConnectPtr dconn,
         virNetSocketClose(socks[i]);
         virObjectUnref(socks[i]);
     }
+    /* Remove virDomainObj from domain list */
+    if (vm) {
+        virDomainObjListRemove(driver->domains, vm);
+        vm = NULL;
+    }
 
  done:
     virURIFree(uri);

diff --git a/src/libxl/libxl_migration.h b/src/libxl/libxl_migration.h
index aab96f54fb643543ee6ff6630dd070e9781f16ff..20b45d86ddeadcdf6db782a2efd12d7ca08aa685 100644 (file)
--- a/src/libxl/libxl_migration.h
+++ b/src/libxl/libxl_migration.h
@@ -50,7 +50,7 @@ libxlDomainMigrationPrepareDef(libxlDriverPrivatePtr driver,
 
 int
 libxlDomainMigrationPrepare(virConnectPtr dconn,
-                            virDomainDefPtr def,
+                            virDomainDefPtr *def,
                             const char *uri_in,
                             char **uri_out,
                             unsigned int flags);