[Libwebsockets] libwebsockets loses an event in the poll loop if another FD is closed during that iteration of the poll loop

Andy Green andy at warmcat.com
Thu Oct 15 02:38:44 CEST 2015

On 31 May 2015 05:35:00 GMT+09:00, Bruce Perens <bruce at perens.com> wrote:
>I also see a call to libwebsocket_service_timeout_check() followed by
>polldf->revents = 0;
>That can cause the same problem. There may be others.

Thanks... yes, you're right.

I fixed these but I couldn't see any other remaining paths to invalidate pollfd.


>On Sat, May 30, 2015 at 1:14 PM, Bruce Perens <bruce at perens.com> wrote:
>> Libwebsockets can lose an event in a poll loop, if another of the FDs
>> the poll FD array is closed during that iteration of the poll loop.
>> At the end of* libsocket_service_fd()*,
>> *libwebsocket_close_and_free_session()* causes a callback to the
>> application with *LWS_CALLBACK_DEL_POLL_FD*. After that, it sets
>> = 0;*
>> But the application has changed the poll fd array in response to
>> *LWS_CALLBACK_DEL_POLL_FD*, and *pollfd* now points to different data
>> than it previously did. Thus, *revents* is zeroed for the wrong FD.
>> The symptom of this is that poll() returns a positive integer, and
>> number of FDs with revents set is less than the value poll()
>>     Thanks
>>     Bruce
>Libwebsockets mailing list
>Libwebsockets at ml.libwebsockets.org

More information about the Libwebsockets mailing list