reactor: fix bug when handling EBADF in flush_pending_aio()

When io_submit() fails with EBADF, we're supposed to only remove the bad request from _pending_aio. However, we're using the error returned by io_submit() to erase elements, which results in a segfault. Spotted while auditing code. Signed-off-by: Raphael Carvalho <[email protected]> Message-Id: <[email protected]>
piboye · Oct 9, 2016 · c5f532e · c5f532e
1 parent 6236442
commit c5f532e
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/core/reactor.cc b/core/reactor.cc
@@ -623,6 +623,8 @@ reactor::flush_pending_aio() {
                     }
                     delete pr;
                     _io_context_available.signal(1);
+                    // if EBADF, it means that the first request has a bad fd, so
+                    // we will only remove it from _pending_aio and try again.
                     nr_consumed = 1;
                     break;
                 }
@@ -638,7 +640,7 @@ reactor::flush_pending_aio() {
         if (nr_consumed == nr) {
             _pending_aio.clear();
         } else {
-            _pending_aio.erase(_pending_aio.begin(), _pending_aio.begin() + r);
+            _pending_aio.erase(_pending_aio.begin(), _pending_aio.begin() + nr_consumed);
         }
     }
     return did_work;