NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

event: fix event-handling data race

Browse Source 
This bug has been present since before the time that commit
f8a519 (Dec 2008) tried to make the dispatch loop re-entrant.

Dereferencing eventLoop.handles outside the lock risks crashing, since
any other thread could have reallocated the array in the meantime.
It's a narrow race window, however, and one that would have most
likely resulted in passing bogus data to the callback rather than
actually causing a segv, which is probably why it has gone undetected
this long.

* daemon/event.c (virEventDispatchHandles): Cache data while
inside the lock, as the array might be reallocated once outside.
This commit is contained in:
Eric Blake 2011-01-21 12:57:03 -07:00
parent ae0cdd4710
commit a11bd2e6cc
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
daemon/event.c
View File

@ -1,7 +1,7 @@
/* /*
* event.c: event loop for monitoring file handles * event.c: event loop for monitoring file handles
* *
* Copyright (C) 2007, 2010 Red Hat, Inc. * Copyright (C) 2007, 2010-2011 Red Hat, Inc.
* Copyright (C) 2007 Daniel P. Berrange * Copyright (C) 2007 Daniel P. Berrange
* *
* This library is free software; you can redistribute it and/or * This library is free software; you can redistribute it and/or
@ -458,14 +458,13 @@ static int virEventDispatchHandles(int nfds, struct pollfd *fds) {
if (fds[n].revents) { if (fds[n].revents) {
virEventHandleCallback cb = eventLoop.handles[i].cb; virEventHandleCallback cb = eventLoop.handles[i].cb;
int watch = eventLoop.handles[i].watch;
void *opaque = eventLoop.handles[i].opaque; void *opaque = eventLoop.handles[i].opaque;
int hEvents = virPollEventToEventHandleType(fds[n].revents); int hEvents = virPollEventToEventHandleType(fds[n].revents);
EVENT_DEBUG("Dispatch n=%d f=%d w=%d e=%d %p", i, EVENT_DEBUG("Dispatch n=%d f=%d w=%d e=%d %p", i,
fds[n].fd, eventLoop.handles[i].watch, fds[n].fd, watch, fds[n].revents, opaque);
fds[n].revents, eventLoop.handles[i].opaque);
virMutexUnlock(&eventLoop.lock); virMutexUnlock(&eventLoop.lock);
(cb)(eventLoop.handles[i].watch, (cb)(watch, fds[n].fd, hEvents, opaque);
fds[n].fd, hEvents, opaque);
virMutexLock(&eventLoop.lock); virMutexLock(&eventLoop.lock);
} }
} }