From owner-freebsd-bugs@FreeBSD.ORG Wed Jun 20 07:50:09 2012 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A35631065670 for ; Wed, 20 Jun 2012 07:50:09 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 7C5078FC1C for ; Wed, 20 Jun 2012 07:50:09 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q5K7o996021879 for ; Wed, 20 Jun 2012 07:50:09 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q5K7o9cd021878; Wed, 20 Jun 2012 07:50:09 GMT (envelope-from gnats) Resent-Date: Wed, 20 Jun 2012 07:50:09 GMT Resent-Message-Id: <201206200750.q5K7o9cd021878@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jukka Ukkonen Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id A91D2106564A for ; Wed, 20 Jun 2012 07:43:43 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 7B19B8FC14 for ; Wed, 20 Jun 2012 07:43:43 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id q5K7hheU093973 for ; Wed, 20 Jun 2012 07:43:43 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id q5K7hh55093972; Wed, 20 Jun 2012 07:43:43 GMT (envelope-from nobody) Message-Id: <201206200743.q5K7hh55093972@red.freebsd.org> Date: Wed, 20 Jun 2012 07:43:43 GMT From: Jukka Ukkonen To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/169260: libkvm to use O_CLOEXEC to avoid file descriptor leaks in threaded code X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Jun 2012 07:50:09 -0000 >Number: 169260 >Category: kern >Synopsis: libkvm to use O_CLOEXEC to avoid file descriptor leaks in threaded code >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jun 20 07:50:09 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Jukka Ukkonen >Release: FreeBSD 9.0-STABLE >Organization: ----- >Environment: FreeBSD sleipnir 9.0-STABLE FreeBSD 9.0-STABLE #0: Tue Jun 19 22:26:46 EEST 2012 root@sleipnir:/usr/obj/usr/src/sys/Sleipnir amd64 >Description: In libkvm files have been opened using a call sequence... xxxfd = open (...); fcntl (xxxfd, F_SETFD, FD_CLOEXEC); In threaded code this could lead to the newly opened fd leaking to a child program, if another thread happened to call exec() during the short time window between open() and fcntl(). Now that there is O_CLOEXEC available, there is an atomic alternative... xxxfd = open (..., O_CLOEXEC); >How-To-Repeat: See full description. >Fix: Apply the attached patch. Patch attached with submission follows: --- lib/libkvm/kvm.c.orig 2012-06-17 17:48:21.000000000 +0300 +++ lib/libkvm/kvm.c 2012-06-17 17:55:25.000000000 +0300 @@ -166,7 +166,7 @@ if (mf == 0) mf = _PATH_MEM; - if ((kd->pmfd = open(mf, flag, 0)) < 0) { + if ((kd->pmfd = open(mf, (flag | O_CLOEXEC), 0)) < 0) { _kvm_syserr(kd, kd->program, "%s", mf); goto failed; } @@ -179,10 +179,7 @@ _kvm_syserr(kd, kd->program, "empty file"); goto failed; } - if (fcntl(kd->pmfd, F_SETFD, FD_CLOEXEC) < 0) { - _kvm_syserr(kd, kd->program, "%s", mf); - goto failed; - } + if (S_ISCHR(st.st_mode)) { /* * If this is a character special device, then check that @@ -191,17 +188,16 @@ * case you're working with a live kernel.) */ if (strcmp(mf, _PATH_DEVNULL) == 0) { - kd->vmfd = open(_PATH_DEVNULL, O_RDONLY); + kd->vmfd = open(_PATH_DEVNULL, + (O_RDONLY | O_CLOEXEC)); return (kd); } else if (strcmp(mf, _PATH_MEM) == 0) { - if ((kd->vmfd = open(_PATH_KMEM, flag)) < 0) { - _kvm_syserr(kd, kd->program, "%s", _PATH_KMEM); - goto failed; - } - if (fcntl(kd->vmfd, F_SETFD, FD_CLOEXEC) < 0) { + if ((kd->vmfd = open(_PATH_KMEM, + (flag | O_CLOEXEC))) < 0) { _kvm_syserr(kd, kd->program, "%s", _PATH_KMEM); goto failed; } + return (kd); } } @@ -210,14 +206,11 @@ * Initialize the virtual address translation machinery, * but first setup the namelist fd. */ - if ((kd->nlfd = open(uf, O_RDONLY, 0)) < 0) { - _kvm_syserr(kd, kd->program, "%s", uf); - goto failed; - } - if (fcntl(kd->nlfd, F_SETFD, FD_CLOEXEC) < 0) { + if ((kd->nlfd = open(uf, (O_RDONLY | O_CLOEXEC), 0)) < 0) { _kvm_syserr(kd, kd->program, "%s", uf); goto failed; } + if (strncmp(mf, _PATH_FWMEM, strlen(_PATH_FWMEM)) == 0) kd->rawdump = 1; if (_kvm_initvtop(kd) < 0) >Release-Note: >Audit-Trail: >Unformatted: