From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Sun, 18 Feb 2018 22:20:05 +0000 (+0100)
Subject: {commands,start}: remove element from list first
X-Git-Tag: lxc-2.0.10~264
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7669dc3415df97f3062af07a00a31f73f6af0ada;p=thirdparty%2Flxc.git

{commands,start}: remove element from list first

First remove the client from the list then close the fd. Otherwise we open
ourselves to a race where another codepath might be writing to a bad file
descriptor.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---

diff --git a/src/lxc/commands.c b/src/lxc/commands.c
index 8f241d461..302fc4012 100644
--- a/src/lxc/commands.c
+++ b/src/lxc/commands.c
@@ -1021,8 +1021,8 @@ static void lxc_cmd_fd_cleanup(int fd, struct lxc_handler *handler,
 			continue;
 
 		/* kick client from list */
-		close(client->clientfd);
 		lxc_list_del(cur);
+		close(client->clientfd);
 		free(cur->elem);
 		free(cur);
 		/* No need to walk the whole list. If we found the state client
diff --git a/src/lxc/start.c b/src/lxc/start.c
index b31747dc9..a24c93f35 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -418,8 +418,8 @@ int lxc_serve_state_clients(const char *name, struct lxc_handler *handler,
 		}
 
 		/* kick client from list */
-		close(client->clientfd);
 		lxc_list_del(cur);
+		close(client->clientfd);
 		free(cur->elem);
 		free(cur);
 	}