x86, shadow: Fix OOS bug on domain teardown.

Signed-off-by: Gianluca Guida <gianluca.guida@eu.citrix.com>

diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index 6979d583c7fe4e24ffc41f1b8f4f3709c2af1915..34cddea6d785c67e0cf350f5b47ac0ab4b4b3079 100644 (file)
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -631,6 +631,11 @@ void oos_fixup_remove(struct vcpu *v, mfn_t gmfn)
 
     perfc_incr(shadow_oos_fixup_remove);
 
+    /* If the domain is dying we might get called when deallocating
+     * the shadows. Fixup tables are already freed so exit now. */
+    if ( d->is_dying )
+        return;
+
     idx = mfn_x(gmfn) % SHADOW_OOS_FT_HASH;
     for_each_vcpu(d, v)
     {
@@ -3168,6 +3173,7 @@ void shadow_teardown(struct domain *d)
         {
             free_xenheap_pages(v->arch.paging.shadow.oos_fixups,
                                SHADOW_OOS_FT_ORDER);
+            v->arch.paging.shadow.oos_fixups = NULL;
         }
 
         {