From owner-freebsd-threads@FreeBSD.ORG Tue Dec 7 14:40:12 2010 Return-Path: Delivered-To: freebsd-threads@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 87D5610656B0 for ; Tue, 7 Dec 2010 14:40:12 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 555008FC23 for ; Tue, 7 Dec 2010 14:40:12 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id oB7EeCi0018512 for ; Tue, 7 Dec 2010 14:40:12 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id oB7EeCk5018511; Tue, 7 Dec 2010 14:40:12 GMT (envelope-from gnats) Date: Tue, 7 Dec 2010 14:40:12 GMT Message-Id: <201012071440.oB7EeCk5018511@freefall.freebsd.org> To: freebsd-threads@FreeBSD.org From: John Baldwin Cc: Subject: Re: threads/79887: [patch] freopen() isn't thread-safe X-BeenThere: freebsd-threads@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: John Baldwin List-Id: Threading on FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Dec 2010 14:40:14 -0000 The following reply was made to PR threads/79887; it has been noted by GNATS. From: John Baldwin To: bug-followup@freebsd.org, tejblum@yandex-team.ru Cc: David Xu Subject: Re: threads/79887: [patch] freopen() isn't thread-safe Date: Tue, 7 Dec 2010 09:31:36 -0500 David, I think the submitter's analysis is correct that the only place that can set the close function pointer is funopen() and that for that case (and any other "fake" files), the file descriptor will be -1. If the fd is >= 0, then it must be a file-descriptor-backed FILE, and relying on dup2() to close the fd is ok. As the manpage notes, the most common usage is to redirect stderr or stdout by doing 'freopen("/dev/null", "w", stderr)'. The bug allows some other random code that is calling open() in another thread to have that open() return 2 during the window where fd '2' is closed during freopen(). That other file descriptor then gets trounced by the dup2() call in freopen() to point to something else. The code likely uses _close() rather than close() directly to be cleaner. Given that this is stdio, I don't think we are really worried about the performance impact of one extra wrapper function. I think the original patch is most likely correct. -- John Baldwin