File c4f66bb8-libxl-mig-prepare.patch of Package libvirt.239

commit c4f66bb8bef796357d509960d5bb65153f586a1f
Author: Jim Fehlig <jfehlig@suse.com>
Date:   Tue Jul 8 11:15:34 2014 -0600

    libxl: remove domain when migration prepare fails
    
    In libxlDomainMigrationPrepare(), a new virDomainObj is created
    from the incoming domain def and added to the driver's domain
    list, but never removed if there are subsequent failures during
    the prepare phase.
    
    targethost# virsh list --all
    
    sourcehost# virsh migrate --live dom xen+ssh://targethost/system
       error: operation failed: Fail to create socket for incoming migration.
    
    targethost# virsh list --all
    error: Failed to list domains
    error: name in virGetDomain must not be NULL
    
    After adding code to remove the domain on prepare failure, noticed
    that libvirtd crashed due to double free of the virDomainDef.  Similar
    to the qemu driver, pass a pointer to virDomainDefPtr so it can be set
    to NULL once a virDomainObj is created from it.

Index: libvirt-1.2.5/src/libxl/libxl_driver.c
===================================================================
--- libvirt-1.2.5.orig/src/libxl/libxl_driver.c
+++ libvirt-1.2.5/src/libxl/libxl_driver.c
@@ -4440,7 +4440,7 @@ libxlDomainMigratePrepare3Params(virConn
     if (virDomainMigratePrepare3ParamsEnsureACL(dconn, def) < 0)
         goto error;
 
-    if (libxlDomainMigrationPrepare(dconn, def, uri_in, uri_out, flags) < 0)
+    if (libxlDomainMigrationPrepare(dconn, &def, uri_in, uri_out, flags) < 0)
         goto error;
 
     return 0;
Index: libvirt-1.2.5/src/libxl/libxl_migration.c
===================================================================
--- libvirt-1.2.5.orig/src/libxl/libxl_migration.c
+++ libvirt-1.2.5/src/libxl/libxl_migration.c
@@ -266,7 +266,7 @@ libxlDomainMigrationPrepareDef(libxlDriv
 
 int
 libxlDomainMigrationPrepare(virConnectPtr dconn,
-                            virDomainDefPtr def,
+                            virDomainDefPtr *def,
                             const char *uri_in,
                             char **uri_out,
                             unsigned int flags)
@@ -284,12 +284,13 @@ libxlDomainMigrationPrepare(virConnectPt
     size_t i;
     int ret = -1;
 
-    if (!(vm = virDomainObjListAdd(driver->domains, def,
+    if (!(vm = virDomainObjListAdd(driver->domains, *def,
                                    driver->xmlopt,
                                    VIR_DOMAIN_OBJ_LIST_ADD_LIVE |
                                    VIR_DOMAIN_OBJ_LIST_ADD_CHECK_LIVE,
                                    NULL)))
         goto error;
+    *def = NULL;
 
     /* Create socket connection to receive migration data */
     if (!uri_in) {
@@ -406,6 +407,11 @@ libxlDomainMigrationPrepare(virConnectPt
         virNetSocketClose(socks[i]);
         virObjectUnref(socks[i]);
     }
+    /* Remove virDomainObj from domain list */
+    if (vm) {
+        virDomainObjListRemove(driver->domains, vm);
+        vm = NULL;
+    }
 
  done:
     virURIFree(uri);
Index: libvirt-1.2.5/src/libxl/libxl_migration.h
===================================================================
--- libvirt-1.2.5.orig/src/libxl/libxl_migration.h
+++ libvirt-1.2.5/src/libxl/libxl_migration.h
@@ -50,7 +50,7 @@ libxlDomainMigrationPrepareDef(libxlDriv
 
 int
 libxlDomainMigrationPrepare(virConnectPtr dconn,
-                            virDomainDefPtr def,
+                            virDomainDefPtr *def,
                             const char *uri_in,
                             char **uri_out,
                             unsigned int flags);