From owner-freebsd-current@FreeBSD.ORG  Sun Dec 28 10:05:39 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A34C716A4CE
	for <freebsd-current@freebsd.org>;
	Sun, 28 Dec 2003 10:05:39 -0800 (PST)
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by mx1.FreeBSD.org (Postfix) with SMTP id E401743D1D
	for <freebsd-current@freebsd.org>;
	Sun, 28 Dec 2003 10:05:37 -0800 (PST)
	(envelope-from dwmalone@maths.tcd.ie)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa55828@salmon>; 28 Dec 2003 18:05:36 +0000 (GMT)
Date: Sun, 28 Dec 2003 18:05:36 +0000
From: David Malone <dwmalone@maths.tcd.ie>
To: freebsd-current@freebsd.org
Message-ID: <20031228180536.GA49762@walton.maths.tcd.ie>
References: <20031227205000.GG86308@e-Gitt.NET>
	<1035.1072561906@critter.freebsd.dk> <20031228001529.GQ86308@e-Gitt.NET>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20031228001529.GQ86308@e-Gitt.NET>
User-Agent: Mutt/1.5.3i
Sender: dwmalone@maths.tcd.ie
Subject: Re: file descriptor leak in 5.2-RC
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 28 Dec 2003 18:05:39 -0000

> I'd call it a surprise if someone after all had a fix within the next 10
> hours or so.

I'm fairly certain I've found the problem (and, indeed, it looks
like I introduced it too while changing how falloc works). You loose
a reference to /dev/null every time you exec a suid program with
at least one of std{in,out,err} closed. I'm guessing that some part
of postfix does this.

I believe the patch below will fix the problem. I guess I'm too
late for you to test it now?

	David.


Index: kern_descrip.c
===================================================================
RCS file: /cvs/FreeBSD-CVS/src/sys/kern/kern_descrip.c,v
retrieving revision 1.215
diff -u -r1.215 kern_descrip.c
--- kern_descrip.c	19 Oct 2003 20:41:06 -0000	1.215
+++ kern_descrip.c	28 Dec 2003 17:55:00 -0000
@@ -1730,6 +1730,7 @@
 			fp->f_type = DTYPE_VNODE;
 			VOP_UNLOCK(nd.ni_vp, 0, td);
 			devnull = fd;
+			fdrop(fp, td);
 		} else {
 			error = do_dup(td, DUP_FIXED, devnull, i, &retval);
 			if (error != 0)