From owner-freebsd-hackers@FreeBSD.ORG  Sun Oct  5 17:15:03 2014
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 7E78F48E
 for <freebsd-hackers@freebsd.org>; Sun,  5 Oct 2014 17:15:03 +0000 (UTC)
Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 0AE89F77
 for <freebsd-hackers@freebsd.org>; Sun,  5 Oct 2014 17:15:02 +0000 (UTC)
Received: from tom.home (kostik@localhost [127.0.0.1])
 by kib.kiev.ua (8.14.9/8.14.9) with ESMTP id s95HEwTT085635
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
 Sun, 5 Oct 2014 20:14:58 +0300 (EEST)
 (envelope-from kostikbel@gmail.com)
DKIM-Filter: OpenDKIM Filter v2.9.2 kib.kiev.ua s95HEwTT085635
Received: (from kostik@localhost)
 by tom.home (8.14.9/8.14.9/Submit) id s95HEwtq085634;
 Sun, 5 Oct 2014 20:14:58 +0300 (EEST)
 (envelope-from kostikbel@gmail.com)
X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com
 using -f
Date: Sun, 5 Oct 2014 20:14:58 +0300
From: Konstantin Belousov <kostikbel@gmail.com>
To: Mateusz Guzik <mjguzik@gmail.com>, freebsd-hackers@freebsd.org
Subject: Re: fork: hold newly created processes
Message-ID: <20141005171457.GA26076@kib.kiev.ua>
References: <20141005102912.GB9262@dft-labs.eu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20141005102912.GB9262@dft-labs.eu>
User-Agent: Mutt/1.5.23 (2014-03-12)
X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00,
 DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no
 autolearn_force=no version=3.4.0
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on tom.home
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers/>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 05 Oct 2014 17:15:03 -0000

On Sun, Oct 05, 2014 at 12:29:12PM +0200, Mateusz Guzik wrote:
> fork: hold newly created processes
> 
> Consumers of fork1 -> do_fork receive new proc pointer, but nothing
> guarnatees its stability at that time.
> 
> New process could already exit and be waited for, in which case we get a
> use after free.
Since the new process is the child of the current process, it can happen
only if the code is self-inflicting.  I can imagine that the only way
to achieve it, do wait() in other thread.

That said, there is no harm for the kernel state, since struct proc is
type-stable, so we do not dereference a random memory, do you agree ?
We could return non-existing or reused pid, but this can occur with
your patch as well, since the same exit/wait could be done while forking
thread executes syscall return code.