| Summary: | drmHandleEvent returns 0 on read() failure | ||
|---|---|---|---|
| Product: | DRI | Reporter: | Michael Gold <mgold> |
| Component: | libdrm | Assignee: | Default DRI bug account <dri-devel> |
| Status: | RESOLVED MOVED | QA Contact: | |
| Severity: | normal | ||
| Priority: | medium | ||
| Version: | XOrg git | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/mesa/drm/issues/11. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
drmHandleEvent contains this code: len = read(fd, buffer, sizeof buffer); if (len == 0) return 0; if (len < sizeof *e) return -1; In the (len < sizeof *e) check, len gets promoted to size_t (which is unsigned); so when len is negative "return -1" won't be executed. Instead, the function continues to the end and returns 0. (The documentation states drmHandleEvent will return -1 if the read fails.) If there's an error like EBADF, the caller won't detect it and might end up busy-waiting. Rewriting the condition as (len < (int)(sizeof *e)) will fix this.