xen: Fix domain teardown to avoid use-after-free of vcpu structs.

Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/xen/common/domain.c b/xen/common/domain.c
index b4b339c94733ac6475602c1cfe4130673feb2872..13b02d1439741338e4a9854f5fd1adfe9a7796f1 100644 (file)
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -467,7 +467,6 @@ static void complete_domain_destroy(struct rcu_head *head)
             continue;
         vcpu_destroy(v);
         sched_destroy_vcpu(v);
-        free_vcpu_struct(v);
     }
 
     acm_domain_destroy(d);
@@ -481,6 +480,10 @@ static void complete_domain_destroy(struct rcu_head *head)
 
     sched_destroy_domain(d);
 
+    for ( i = MAX_VIRT_CPUS-1; i >= 0; i-- )
+        if ( (v = d->vcpu[i]) != NULL )
+            free_vcpu_struct(v);
+
     free_domain(d);
 
     send_guest_global_virq(dom0, VIRQ_DOM_EXC);