From: Adrian Vovk <adrianvovk@gmail.com>
Date: Thu, 21 Mar 2024 17:51:16 +0000 (-0400)
Subject: homed: Ensure closed FD is handled before bus req
X-Git-Tag: v256-rc1~438
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9a077230a4c3e7192c66ed7fa7439eb85893aaee;p=thirdparty%2Fsystemd.git

homed: Ensure closed FD is handled before bus req

Before this fix, the following sequence of events was possible:
1. A client holding a Ref() FD closes their FD
2. kernel sends notification that all clients closed their FDs
3. Another client obtains its own Ref() FD from homed
4. homed handles the notification that all clients have closed their
   Ref() FDs. Thus it loses track of the fact that the session is
   actually still being held open by the client from step 3

This change makes sure that homed won't respond to bus messages (and
thus won't open more Ref() FDs) until it has handled all notifications
about the existing FDs being closed.

logind has had a very similar fix applied to it in
e11544a8305ab9dea097c74bb16e296150c9cc10

Fixes https://github.com/systemd/systemd/issues/31518
---

diff --git a/src/home/homed-home.c b/src/home/homed-home.c
index e1379f51f58..09e86f37f36 100644
--- a/src/home/homed-home.c
+++ b/src/home/homed-home.c
@@ -2756,7 +2756,9 @@ int home_create_fifo(Home *h, bool please_suspend) {
 
                 (void) sd_event_source_set_description(*ss, "acquire-ref");
 
-                r = sd_event_source_set_priority(*ss, SD_EVENT_PRIORITY_IDLE-1);
+                /* We need to notice dropped refs before we process new bus requests (which
+                 * might try to obtain new refs) */
+                r = sd_event_source_set_priority(*ss, SD_EVENT_PRIORITY_NORMAL-10);
                 if (r < 0)
                         return r;
 
diff --git a/src/home/homed-manager.c b/src/home/homed-manager.c
index 0653eeef784..d4eaf1821b4 100644
--- a/src/home/homed-manager.c
+++ b/src/home/homed-manager.c
@@ -991,7 +991,7 @@ static int manager_connect_bus(Manager *m) {
         if (r < 0)
                 return log_error_errno(r, "Failed to request name: %m");
 
-        r = sd_bus_attach_event(m->bus, m->event, 0);
+        r = sd_bus_attach_event(m->bus, m->event, SD_EVENT_PRIORITY_NORMAL);
         if (r < 0)
                 return log_error_errno(r, "Failed to attach bus to event loop: %m");