If epoll_ctl fails, the descr->ev array isinconsistent

Let's take an example:

fd = open(..) /* fd = 3 for example */

lxc_mainloop_add_handler(descr, fd, cb1, data1) fails.

the program take care of the error, it closes the fd

Later, reopen a fd (get 3 for again)

lxc_mainloop_add_handler(desc, fd, cb2, data2) is ok.

When something happen on fd, cb1 with data1 will be called instead of
cb2 with data2, because descr->ev contains 2 entries for fd == 3.

Signed-off-by: Clement Calmels <clement.calmels@fr.ibm.com>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>

diff --git a/src/lxc/mainloop.c b/src/lxc/mainloop.c
index fcae73995dcc3796687b0157ccb318b0a7a75089..03d178f9e72bf3d1882ddf4e2864486daff20d39 100644 (file)
--- a/src/lxc/mainloop.c
+++ b/src/lxc/mainloop.c
@@ -81,7 +81,6 @@ int lxc_mainloop_add_handler(struct lxc_epoll_descr *descr, int fd,
 {
        struct epoll_event *ev;
        struct mainloop_handler *handler;
-       int ret = -1;
 
        handler = malloc(sizeof(*handler));
        if (!handler)
@@ -95,25 +94,24 @@ int lxc_mainloop_add_handler(struct lxc_epoll_descr *descr, int fd,
        if (!ev)
                goto out_free;
 
-       if (descr->nfds) {
-               memcpy(ev, descr->ev, sizeof(*descr->ev) * (descr->nfds));
-               free(descr->ev);
-       }
+       memcpy(ev, descr->ev, sizeof(*descr->ev) * (descr->nfds));
 
-       descr->ev = ev;
-       descr->ev[descr->nfds].events = EPOLLIN;
-       descr->ev[descr->nfds].data.ptr = handler;
+       ev[descr->nfds].events = EPOLLIN;
+       ev[descr->nfds].data.ptr = handler;
 
-       ret = epoll_ctl(descr->epfd, EPOLL_CTL_ADD, fd, 
-                       &descr->ev[descr->nfds]);
+       if (epoll_ctl(descr->epfd, EPOLL_CTL_ADD, fd, &ev[descr->nfds]) < 0) {
+               free(ev);
+               goto out_free;
+       }
 
+       free(descr->ev);
+       descr->ev = ev;
        descr->nfds++;
-out:
-       return ret;
+       return 0;
 
 out_free:
        free(handler);
-       goto out;
+       return -1;
 }
 
 int lxc_mainloop_del_handler(struct lxc_epoll_descr *descr, int fd)