From owner-svn-src-all@FreeBSD.ORG Sun Apr 7 15:26:10 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id AEC7D728; Sun, 7 Apr 2013 15:26:10 +0000 (UTC) (envelope-from jilles@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 91302160; Sun, 7 Apr 2013 15:26:10 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r37FQAdo093029; Sun, 7 Apr 2013 15:26:10 GMT (envelope-from jilles@svn.freebsd.org) Received: (from jilles@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r37FQAt7093026; Sun, 7 Apr 2013 15:26:10 GMT (envelope-from jilles@svn.freebsd.org) Message-Id: <201304071526.r37FQAt7093026@svn.freebsd.org> From: Jilles Tjoelker Date: Sun, 7 Apr 2013 15:26:10 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r249233 - head/sys/kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Apr 2013 15:26:10 -0000 Author: jilles Date: Sun Apr 7 15:26:09 2013 New Revision: 249233 URL: http://svnweb.freebsd.org/changeset/base/249233 Log: mqueue,ksem,shm: Fix race condition with setting UF_EXCLOSE. POSIX mqueue, compatibility ksem and POSIX shm create a file descriptor that has close-on-exec set. However, they do this incorrectly, leaving a window where a thread may fork and exec while the flag has not been set yet. The race is easily reproduced on a multicore system with one thread doing shm_open and close and another thread doing posix_spawnp and waitpid. Set UF_EXCLOSE via falloc()'s flags argument instead. This also simplifies the code. MFC after: 1 week Modified: head/sys/kern/uipc_mqueue.c head/sys/kern/uipc_sem.c head/sys/kern/uipc_shm.c Modified: head/sys/kern/uipc_mqueue.c ============================================================================== --- head/sys/kern/uipc_mqueue.c Sun Apr 7 13:03:57 2013 (r249232) +++ head/sys/kern/uipc_mqueue.c Sun Apr 7 15:26:09 2013 (r249233) @@ -1977,7 +1977,7 @@ kern_kmq_open(struct thread *td, const c if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL) return (EINVAL); - error = falloc(td, &fp, &fd, 0); + error = falloc(td, &fp, &fd, O_CLOEXEC); if (error) return (error); @@ -2032,10 +2032,6 @@ kern_kmq_open(struct thread *td, const c finit(fp, flags & (FREAD | FWRITE | O_NONBLOCK), DTYPE_MQUEUE, pn, &mqueueops); - FILEDESC_XLOCK(fdp); - if (fdp->fd_ofiles[fd].fde_file == fp) - fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE; - FILEDESC_XUNLOCK(fdp); td->td_retval[0] = fd; fdrop(fp, td); return (0); Modified: head/sys/kern/uipc_sem.c ============================================================================== --- head/sys/kern/uipc_sem.c Sun Apr 7 13:03:57 2013 (r249232) +++ head/sys/kern/uipc_sem.c Sun Apr 7 15:26:09 2013 (r249233) @@ -485,7 +485,7 @@ ksem_create(struct thread *td, const cha fdp = td->td_proc->p_fd; mode = (mode & ~fdp->fd_cmask) & ACCESSPERMS; - error = falloc(td, &fp, &fd, 0); + error = falloc(td, &fp, &fd, O_CLOEXEC); if (error) { if (name == NULL) error = ENOSPC; @@ -578,10 +578,6 @@ ksem_create(struct thread *td, const cha finit(fp, FREAD | FWRITE, DTYPE_SEM, ks, &ksem_ops); - FILEDESC_XLOCK(fdp); - if (fdp->fd_ofiles[fd].fde_file == fp) - fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE; - FILEDESC_XUNLOCK(fdp); fdrop(fp, td); return (0); Modified: head/sys/kern/uipc_shm.c ============================================================================== --- head/sys/kern/uipc_shm.c Sun Apr 7 13:03:57 2013 (r249232) +++ head/sys/kern/uipc_shm.c Sun Apr 7 15:26:09 2013 (r249233) @@ -534,7 +534,7 @@ sys_shm_open(struct thread *td, struct s fdp = td->td_proc->p_fd; cmode = (uap->mode & ~fdp->fd_cmask) & ACCESSPERMS; - error = falloc(td, &fp, &fd, 0); + error = falloc(td, &fp, &fd, O_CLOEXEC); if (error) return (error); @@ -629,10 +629,6 @@ sys_shm_open(struct thread *td, struct s finit(fp, FFLAGS(uap->flags & O_ACCMODE), DTYPE_SHM, shmfd, &shm_ops); - FILEDESC_XLOCK(fdp); - if (fdp->fd_ofiles[fd].fde_file == fp) - fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE; - FILEDESC_XUNLOCK(fdp); td->td_retval[0] = fd; fdrop(fp, td);