From 300d1cb40a436e7592e08eb47f249d3cc92aa3e1 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sun, 18 Feb 2018 23:20:05 +0100 Subject: [PATCH] {commands,start}: remove element from list first First remove the client from the list then close the fd. Otherwise we open ourselves to a race where another codepath might be writing to a bad file descriptor. Signed-off-by: Christian Brauner --- src/lxc/commands.c | 2 +- src/lxc/start.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/lxc/commands.c b/src/lxc/commands.c index eae06d9be..277f87b23 100644 --- a/src/lxc/commands.c +++ b/src/lxc/commands.c @@ -1156,8 +1156,8 @@ static void lxc_cmd_fd_cleanup(int fd, struct lxc_handler *handler, continue; /* kick client from list */ - close(client->clientfd); lxc_list_del(cur); + close(client->clientfd); free(cur->elem); free(cur); /* No need to walk the whole list. If we found the state client diff --git a/src/lxc/start.c b/src/lxc/start.c index 228dd2607..a0be7cdea 100644 --- a/src/lxc/start.c +++ b/src/lxc/start.c @@ -427,8 +427,8 @@ int lxc_serve_state_clients(const char *name, struct lxc_handler *handler, } /* kick client from list */ - close(client->clientfd); lxc_list_del(cur); + close(client->clientfd); free(cur->elem); free(cur); }