event: ignore attempts to replace the event loop impl

Although not previously explicitly documented, the expectation for
the libvirt event loop is that an implementation is registered early
in application startup, before calling any libvirt APIs and then
run forever after. Replacing a previously registered event loop is
not safe & subject to races even if virConnectClose has been called
on open handles, due to delayed deregistration of callbacks during
conenction close.
Reviewed-by: NAndrea Bolognani <abologna@redhat.com>
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

src/util/virevent.c

@@ -220,6 +220,13 @@ virEventRemoveTimeout(int timer)
  * existing event loop implementation, then the
  * virEventRegisterDefaultImpl() method can be used to setup
  * the generic libvirt implementation.
+ *
+ * Once registered, the event loop implementation cannot be
+ * changed, and must be run continuously. Note that callbacks
+ * may remain registered for a short time even after calling
+ * virConnectClose on all open connections, so it is not safe
+ * to stop running the event loop immediately after closing
+ * the connection.
  */
 void virEventRegisterImpl(virEventAddHandleFunc addHandle,
                           virEventUpdateHandleFunc updateHandle,
@@ -233,6 +240,12 @@ void virEventRegisterImpl(virEventAddHandleFunc addHandle,
               addHandle, updateHandle, removeHandle,
               addTimeout, updateTimeout, removeTimeout);
 
+    if (addHandleImpl || updateHandleImpl || removeHandleImpl ||
+        addTimeoutImpl || updateTimeoutImpl || removeHandleImpl) {
+        VIR_WARN("Ignoring attempt to replace registered event loop");
+        return;
+    }
+
     addHandleImpl = addHandle;
     updateHandleImpl = updateHandle;
     removeHandleImpl = removeHandle;