libxl: poll: Avoid fd deregistration race POLLNVAL crash
authorIan Jackson <ian.jackson@eu.citrix.com>
Thu, 9 Jul 2015 16:28:48 +0000 (17:28 +0100)
committerIan Jackson <Ian.Jackson@eu.citrix.com>
Wed, 15 Jul 2015 10:40:38 +0000 (11:40 +0100)
commit681ce1681622a46d111cfdc4fc07e4cb565ae131
treea2511e6f939e01671c1fdd626563bf85309a6496
parentaae37652067eafd0f2b85050306772df0cb71f08
libxl: poll: Avoid fd deregistration race POLLNVAL crash

It can happen that an fd is deregistered, and closed, and then a new
fd opened, and reregistered, all while another thread is in poll().

If this happens poll might report POLLNVAL, but the event loop would
think that the fd was supposed to have been valid, and then fail an
assertion:
  libxl_event.c:1183: afterpoll_check_fd: Assertion `poller->fds_changed || !(fds[slot].revents & 0x020)' failed.

We can't simply ignore POLLNVAL because if we have bugs which cause
messed-up fds, it is a serious problem which we really need to detect.

Instead, add extra tracking to spot when this possibility arises, and
abort on POLLNVAL if we are sure that it is unexpected.

Reported-by: Jim Fehlig <jfehlig@suse.com>
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Jim Fehlig <jfehlig@suse.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Tested-by: Jim Fehlig <jfehlig@suse.com>
tools/libxl/libxl.c
tools/libxl/libxl_event.c
tools/libxl/libxl_internal.h