From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Sun, 18 Feb 2018 22:20:05 +0000 (+0100)
Subject: {commands,start}: remove element from list first
X-Git-Tag: lxc-3.0.0.beta1~22^2~26
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=300d1cb40a436e7592e08eb47f249d3cc92aa3e1;p=thirdparty%2Flxc.git

{commands,start}: remove element from list first

First remove the client from the list then close the fd. Otherwise we open
ourselves to a race where another codepath might be writing to a bad file
descriptor.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---

diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index eae06d9be..277f87b23 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -1156,8 +1156,8 @@ static void lxc_cmd_fd_cleanup(int fd, struct lxc_handler *handler,
 			continue;
 
 		/* kick client from list */
-		close(client->clientfd);
 		lxc_list_del(cur);
+		close(client->clientfd);
 		free(cur->elem);
 		free(cur);
 		/* No need to walk the whole list. If we found the state client
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 228dd2607..a0be7cdea 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -427,8 +427,8 @@ int lxc_serve_state_clients(const char *name, struct lxc_handler *handler,
 		}
 
 		/* kick client from list */
-		close(client->clientfd);
 		lxc_list_del(cur);
+		close(client->clientfd);
 		free(cur->elem);
 		free(cur);
 	}