From owner-cvs-src-old@FreeBSD.ORG Fri Oct 31 10:38:34 2008 Return-Path: Delivered-To: cvs-src-old@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8E82A106567C for ; Fri, 31 Oct 2008 10:38:34 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 7D4EF8FC13 for ; Fri, 31 Oct 2008 10:38:34 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id m9VAcYmT023943 for ; Fri, 31 Oct 2008 10:38:34 GMT (envelope-from kib@repoman.freebsd.org) Received: (from svn2cvs@localhost) by repoman.freebsd.org (8.14.3/8.14.3/Submit) id m9VAcYe4023942 for cvs-src-old@freebsd.org; Fri, 31 Oct 2008 10:38:34 GMT (envelope-from kib@repoman.freebsd.org) Message-Id: <200810311038.m9VAcYe4023942@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: svn2cvs set sender to kib@repoman.freebsd.org using -f From: Konstantin Belousov Date: Fri, 31 Oct 2008 10:38:30 +0000 (UTC) To: cvs-src-old@freebsd.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/compat/linux linux_emul.c X-BeenThere: cvs-src-old@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: **OBSOLETE** CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2008 10:38:34 -0000 kib 2008-10-31 10:38:30 UTC FreeBSD src repository Modified files: sys/compat/linux linux_emul.c Log: SVN rev 184501 on 2008-10-31 10:38:30Z by kib The code in linux_proc_exit() contains a race when multiple linux based processes exits at the same time. The linux_emuldata structure is freed but p->p_emuldata is left as a dangling pointer to the just freed memory. The check for W_EXIT in the loop scanning the child processes isn't safe since the state of the child process can change right afterwards. Lock the process and check the W_EXIT before delivering signal. Submitted by: tegge Reviewed by: davidxu MFC after: 1 week Revision Changes Path 1.22 +3 -3 src/sys/compat/linux/linux_emul.c