Commit 3ce45e64 by Clement Calmels Committed by Daniel Lezcano

If epoll_ctl fails, the descr->ev array isinconsistent

Let's take an example: fd = open(..) /* fd = 3 for example */ lxc_mainloop_add_handler(descr, fd, cb1, data1) fails. the program take care of the error, it closes the fd Later, reopen a fd (get 3 for again) lxc_mainloop_add_handler(desc, fd, cb2, data2) is ok. When something happen on fd, cb1 with data1 will be called instead of cb2 with data2, because descr->ev contains 2 entries for fd == 3. Signed-off-by: 's avatarClement Calmels <clement.calmels@fr.ibm.com> Signed-off-by: 's avatarDaniel Lezcano <dlezcano@fr.ibm.com>
parent 312b3ca2
...@@ -81,7 +81,6 @@ int lxc_mainloop_add_handler(struct lxc_epoll_descr *descr, int fd, ...@@ -81,7 +81,6 @@ int lxc_mainloop_add_handler(struct lxc_epoll_descr *descr, int fd,
{ {
struct epoll_event *ev; struct epoll_event *ev;
struct mainloop_handler *handler; struct mainloop_handler *handler;
int ret = -1;
handler = malloc(sizeof(*handler)); handler = malloc(sizeof(*handler));
if (!handler) if (!handler)
...@@ -95,25 +94,24 @@ int lxc_mainloop_add_handler(struct lxc_epoll_descr *descr, int fd, ...@@ -95,25 +94,24 @@ int lxc_mainloop_add_handler(struct lxc_epoll_descr *descr, int fd,
if (!ev) if (!ev)
goto out_free; goto out_free;
if (descr->nfds) { memcpy(ev, descr->ev, sizeof(*descr->ev) * (descr->nfds));
memcpy(ev, descr->ev, sizeof(*descr->ev) * (descr->nfds));
free(descr->ev);
}
descr->ev = ev; ev[descr->nfds].events = EPOLLIN;
descr->ev[descr->nfds].events = EPOLLIN; ev[descr->nfds].data.ptr = handler;
descr->ev[descr->nfds].data.ptr = handler;
ret = epoll_ctl(descr->epfd, EPOLL_CTL_ADD, fd, if (epoll_ctl(descr->epfd, EPOLL_CTL_ADD, fd, &ev[descr->nfds]) < 0) {
&descr->ev[descr->nfds]); free(ev);
goto out_free;
}
free(descr->ev);
descr->ev = ev;
descr->nfds++; descr->nfds++;
out: return 0;
return ret;
out_free: out_free:
free(handler); free(handler);
goto out; return -1;
} }
int lxc_mainloop_del_handler(struct lxc_epoll_descr *descr, int fd) int lxc_mainloop_del_handler(struct lxc_epoll_descr *descr, int fd)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment