From owner-svn-src-head@FreeBSD.ORG  Tue Feb 25 18:47:22 2014
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id ACC2EB04;
 Tue, 25 Feb 2014 18:47:22 +0000 (UTC)
Received: from bigwig.baldwin.cx (bigwig.baldwin.cx [IPv6:2001:470:1f11:75::1])
 (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 8267B1AED;
 Tue, 25 Feb 2014 18:47:22 +0000 (UTC)
Received: from jhbbsd.localnet (unknown [209.249.190.124])
 by bigwig.baldwin.cx (Postfix) with ESMTPSA id 6053EB917;
 Tue, 25 Feb 2014 13:47:20 -0500 (EST)
From: John Baldwin <jhb@freebsd.org>
To: Mateusz Guzik <mjg@freebsd.org>
Subject: Re: svn commit: r262309 - head/sys/kern
Date: Tue, 25 Feb 2014 13:08:43 -0500
User-Agent: KMail/1.13.5 (FreeBSD/8.4-CBSD-20130906; KDE/4.5.5; amd64; ; )
References: <201402212229.s1LMT9BF093587@svn.freebsd.org>
In-Reply-To: <201402212229.s1LMT9BF093587@svn.freebsd.org>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201402251308.43875.jhb@freebsd.org>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7
 (bigwig.baldwin.cx); Tue, 25 Feb 2014 13:47:20 -0500 (EST)
Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org,
 src-committers@freebsd.org
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Feb 2014 18:47:22 -0000

On Friday, February 21, 2014 5:29:09 pm Mateusz Guzik wrote:
> Author: mjg
> Date: Fri Feb 21 22:29:09 2014
> New Revision: 262309
> URL: http://svnweb.freebsd.org/changeset/base/262309
> 
> Log:
>   Fix a race between kern_proc_{o,}filedesc_out and fdescfree leading
>   to use-after-free.
>   
>   fdescfree proceeds to free file pointers once fd_refcnt reaches 0, but
>   kern_proc_{o,}filedesc_out only checked for hold count.

Can you describe the race in more detail?  The kern_* routines hold
FILEDESC_SLOCK() while they read the file which should prevent
fdescfree() from free'ing any files.  Note that fdfree() (called
under FILEDESC_XLOCK() clears the file pointer to NULL via the
bzero(), so the sysctl handler should only see non-NULL pointers
for files that are not yet free'd.

-- 
John Baldwin