]> xenbits.xensource.com Git - xen.git/commit
libxl: poll: Avoid fd deregistration race POLLNVAL crash
authorIan Jackson <ian.jackson@eu.citrix.com>
Thu, 9 Jul 2015 16:28:48 +0000 (17:28 +0100)
committerIan Jackson <Ian.Jackson@eu.citrix.com>
Wed, 12 Aug 2015 11:44:30 +0000 (12:44 +0100)
commit7f7642f778b78e8e204fc082ce03072bb26887c7
treeb8e70439c9b89d29f0616bc10d943aa273407793
parent9f6f513eecbdc76ce30b5f2e6c52e02076bac30b
libxl: poll: Avoid fd deregistration race POLLNVAL crash

It can happen that an fd is deregistered, and closed, and then a new
fd opened, and reregistered, all while another thread is in poll().

If this happens poll might report POLLNVAL, but the event loop would
think that the fd was supposed to have been valid, and then fail an
assertion:
  libxl_event.c:1183: afterpoll_check_fd: Assertion `poller->fds_changed || !(fds[slot].revents & 0x020)' failed.

We can't simply ignore POLLNVAL because if we have bugs which cause
messed-up fds, it is a serious problem which we really need to detect.

Instead, add extra tracking to spot when this possibility arises, and
abort on POLLNVAL if we are sure that it is unexpected.

Reported-by: Jim Fehlig <jfehlig@suse.com>
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Jim Fehlig <jfehlig@suse.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Tested-by: Jim Fehlig <jfehlig@suse.com>
(cherry picked from commit 681ce1681622a46d111cfdc4fc07e4cb565ae131)
tools/libxl/libxl.c
tools/libxl/libxl_event.c
tools/libxl/libxl_internal.h