A simple test program to show up the issue:

-8<---
#include <stdio.h>
#include <unistd.h>

#include "mainloop.h"

struct lxc_epoll_descr loop;

int cb1(int fd, void *data, struct lxc_epoll_descr *descr)
{
	fprintf(stderr, "cb1\n");
        return 1;
}

int cb2(int fd, void *data, struct lxc_epoll_descr *descr)
{
	fprintf(stderr, "cb2\n");
        return 1;
}

int main(int argc, char *argv[])
{
        int ret;
        int fds[2];

        ret = pipe(fds);
        if (ret) {
                perror("pipe:");
                return -1;
        }

        ret = lxc_mainloop_open(&loop);
        if (ret) {
                fprintf(stderr, "lxc_mainloop_open: %d\n", ret);
                return -1;
        }

        ret = lxc_mainloop_add_handler(&loop, fds[1], cb1, NULL);
        if (ret) {
                fprintf(stderr, "lxc_mainloop_add_handler(fds[1]): %d\n", ret);
                return -1;
        }

        ret = lxc_mainloop_add_handler(&loop, fds[0], cb2, NULL);
        if (ret) {
                fprintf(stderr, "lxc_mainloop_add_handler(fds[0]): %d\n", ret);
                return -1;
        }

        write(fds[1], &ret, sizeof(ret));

        ret = lxc_mainloop(&loop);
        if (ret) {
	        fprintf(stderr, "lxc_mainloop: %d\n", ret);
				return -1;
        }

        ret = lxc_mainloop_close(&loop);
        if (ret) {
                fprintf(stderr, "lxc_mainloop_close: %d\n", ret);
                return -1;
        }

        return 0;
}

Compile and run:
$ gcc test.c -o test -I ./src/lxc/ ./src/lxc/liblxc_so-mainloop.o && ./test
cb2
*** glibc detected *** ./test: double free or corruption (fasttop): 0x0000000000c76050 ***
======= Backtrace: =========
/lib/libc.so.6[0x3eb0073948]
/lib/libc.so.6(cfree+0x76)[0x3eb0075a56]
./test[0x400afe]
./test[0x400a94]
/lib/libc.so.6(__libc_start_main+0xe6)[0x3eb001e1a6]
./test[0x400819]
======= Memory map: ========
00400000-00402000 r-xp 00000000 08:03 10977294                           /tmp/test
00601000-00602000 rw-p 00001000 08:03 10977294                           /tmp/test
00c76000-00c97000 rw-p 00c76000 00:00 0                                  [heap]
3eafc00000-3eafc1c000 r-xp 00000000 08:03 212994                         /lib/ld-2.7.so
3eafe1b000-3eafe1d000 rw-p 0001b000 08:03 212994                         /lib/ld-2.7.so
3eb0000000-3eb014a000 r-xp 00000000 08:03 212995                         /lib/libc-2.7.so
3eb014a000-3eb0349000 ---p 0014a000 08:03 212995                         /lib/libc-2.7.so
3eb0349000-3eb034c000 r--p 00149000 08:03 212995                         /lib/libc-2.7.so
3eb034c000-3eb034e000 rw-p 0014c000 08:03 212995                         /lib/libc-2.7.so
3eb034e000-3eb0353000 rw-p 3eb034e000 00:00 0
3ec3000000-3ec3016000 r-xp 00000000 08:03 213016                         /lib/libgcc_s.so.1
3ec3016000-3ec3216000 ---p 00016000 08:03 213016                         /lib/libgcc_s.so.1
3ec3216000-3ec3217000 rw-p 00016000 08:03 213016                         /lib/libgcc_s.so.1
7f9f50000000-7f9f50021000 rw-p 7f9f50000000 00:00 0
7f9f50021000-7f9f54000000 ---p 7f9f50021000 00:00 0
7f9f56eed000-7f9f56eef000 rw-p 7f9f56eed000 00:00 0
7f9f56f01000-7f9f56f04000 rw-p 7f9f56f01000 00:00 0
7fff1784d000-7fff17862000 rw-p 7ffffffea000 00:00 0                      [stack]
7fff179b4000-7fff179b5000 r-xp 7fff179b4000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted

Signed-off-by: Clement Calmels <clement.calmels@fr.ibm.com>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
---

 src/lxc/mainloop.c |   22 +++++++---------------
 1 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/src/lxc/mainloop.c b/src/lxc/mainloop.c
index 03d178f..6b656d1 100644
--- a/src/lxc/mainloop.c
+++ b/src/lxc/mainloop.c
@@ -35,40 +35,32 @@ struct mainloop_handler {
 	void *data;
 };

+#define MAX_EVENTS 10
+
 int lxc_mainloop(struct lxc_epoll_descr *descr)
 {
-	int i, nfds, triggered;
+	int i, nfds;
 	struct mainloop_handler *handler;
+	struct epoll_event events[MAX_EVENTS];

 	for (;;) {

-		triggered = 0;
-
-		nfds = epoll_wait(descr->epfd, descr->ev, descr->nfds, -1);
+		nfds = epoll_wait(descr->epfd, events, MAX_EVENTS, -1);
 		if (nfds < 0) {
 			if (errno == EINTR)
 				continue;
 			return -1;
 		}

-		for (i = 0; i < descr->nfds; i++) {
-
-			if (!(descr->ev[i].events & EPOLLIN) &&
-			    !(descr->ev[i].events & EPOLLHUP))
-				continue;
-
-			triggered++;
+		for (i = 0; i < nfds; i++) {
 			handler =
-			  (struct mainloop_handler *) descr->ev[i].data.ptr;
+				(struct mainloop_handler *) events[i].data.ptr;

 			/* If the handler returns a positive value, exit
 			   the mainloop */
 			if (handler->callback(handler->fd, handler->data, 
 					      descr) > 0)
 				return 0;
-
-			if (triggered == nfds)
-				break;
 		}

 		if (!descr->nfds)


--===============0476404332==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

_______________________________________________
Linux mailing list
Linux@www.lab.toulouse-stg.fr.ibm.com
http://www.lab.toulouse-stg.fr.ibm.com/mailman/listinfo/linux

--===============0476404332==--




