MT#55283 prevent racy reuse of poller slots

Closes #2210

Change-Id: If60d1971fc9f313b5fdf2addef4d698b02d22162

lib/poller.c

@@ -40,6 +40,8 @@ TYPED_GPTRARRAY_FULL(items_arr, struct poller_item_int, poller_free_item)
 
 struct poller {
 	int				fd;
+	int32_t				gen;
+	static_assert(sizeof(int) == sizeof(int32_t), "int fd is not 32 bits");
 	mutex_t				lock;
 	items_arr			*items;
 };
@@ -121,6 +123,8 @@ bool poller_add_item(struct poller *p, struct poller_item *i) {
 	if (i->u.fd < p->items->len && p->items->pdata[i->u.fd])
 		return false;
 
+	i->u.gen = ++p->gen;
+
 	ZERO(e);
 	e.events = epoll_events(i, NULL);
 	e.data.u64 = i->u.u64;
@@ -219,6 +223,9 @@ static int poller_poll(struct poller *p, int timeout, struct epoll_event *evs, i
 		if (!it)
 			continue;
 
+		if (it->item.u.u64 != u64.u64)
+			continue;
+
 		obj_hold(it);
 		mutex_unlock(&p->lock);
 

lib/poller.h

@@ -27,6 +27,7 @@ typedef void (*poller_func_t)(int, void *);
 union poller_item_u64 {
 	struct {
 		int fd;
+		int32_t gen;
 	} __attribute__((packed));
 	uint64_t u64;
 };