Fix: set wait/wake fd to -1 before close

Else triggers double-close race.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

diff --git a/libringbuffer/shm.h b/libringbuffer/shm.h
index 3d22a31305d1268d4ede5604415f236d589aa9b9..a1ddc4cdf2b06dc27f1d1bb55ecea7af339b89ad 100644 (file)
--- a/libringbuffer/shm.h
+++ b/libringbuffer/shm.h
@@ -141,6 +141,7 @@ int shm_close_wait_fd(struct lttng_ust_shm_handle *handle,
 {
        struct shm_object_table *table = handle->table;
        struct shm_object *obj;
+       int wait_fd;
        size_t index;
        int ret;
 
@@ -148,14 +149,15 @@ int shm_close_wait_fd(struct lttng_ust_shm_handle *handle,
        if (caa_unlikely(index >= table->allocated_len))
                return -EPERM;
        obj = &table->objects[index];
-       if (obj->wait_fd[0] < 0)
+       wait_fd = obj->wait_fd[0];
+       if (wait_fd < 0)
                return -ENOENT;
-       ret = close(obj->wait_fd[0]);
+       obj->wait_fd[0] = -1;
+       ret = close(wait_fd);
        if (ret) {
                ret = -errno;
                return ret;
        }
-       obj->wait_fd[0] = -1;
        return 0;
 }
 
@@ -165,6 +167,7 @@ int shm_close_wakeup_fd(struct lttng_ust_shm_handle *handle,
 {
        struct shm_object_table *table = handle->table;
        struct shm_object *obj;
+       int wakeup_fd;
        size_t index;
        int ret;
 
@@ -172,14 +175,15 @@ int shm_close_wakeup_fd(struct lttng_ust_shm_handle *handle,
        if (caa_unlikely(index >= table->allocated_len))
                return -EPERM;
        obj = &table->objects[index];
-       if (obj->wait_fd[1] < 0)
+       wakeup_fd = obj->wait_fd[1];
+       if (wakeup_fd < 0)
                return -ENOENT;
-       ret = close(obj->wait_fd[1]);
+       obj->wait_fd[1] = -1;
+       ret = close(wakeup_fd);
        if (ret) {
                ret = -errno;
                return ret;
        }
-       obj->wait_fd[1] = -1;
        return 0;
 }