https://bugs.freedesktop.org/show_bug.cgi?id=66332

Priority: medium Bug ID: 66332 Assignee: dri-devel@lists.freedesktop.org Summary: drmHandleEvent returns 0 on read() failure Severity: normal Classification: Unclassified OS: All Reporter: mgold@qnx.com Hardware: All Status: NEW Version: XOrg CVS Component: libdrm Product: DRI

drmHandleEvent contains this code: len = read(fd, buffer, sizeof buffer); if (len == 0) return 0; if (len < sizeof *e) return -1; In the (len < sizeof *e) check, len gets promoted to size_t (which is unsigned); so when len is negative "return -1" won't be executed. Instead, the function continues to the end and returns 0. (The documentation states drmHandleEvent will return -1 if the read fails.)

If there's an error like EBADF, the caller won't detect it and might end up busy-waiting. Rewriting the condition as (len < (int)(sizeof *e)) will fix this.