xen: Fix domain teardown to avoid use-after-free of vcpu structs.

Signed-off-by: Keir Fraser <keir@xensource.com>

xen/common/domain.c

@@ -467,7 +467,6 @@ static void complete_domain_destroy(struct rcu_head *head)
             continue;
         vcpu_destroy(v);
         sched_destroy_vcpu(v);
-        free_vcpu_struct(v);
     }
 
     acm_domain_destroy(d);
@@ -481,6 +480,10 @@ static void complete_domain_destroy(struct rcu_head *head)
 
     sched_destroy_domain(d);
 
+    for ( i = MAX_VIRT_CPUS-1; i >= 0; i-- )
+        if ( (v = d->vcpu[i]) != NULL )
+            free_vcpu_struct(v);
+
     free_domain(d);
 
     send_guest_global_virq(dom0, VIRQ_DOM_EXC);