Date: Mon, 27 Jul 2026 19:14:47 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8496ed27ab06 - stable/15 - jaildesc: Publish the new fd only after the jaildesc is initialized Message-ID: <6a67ae27.36b6d.5b0edfe2@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8496ed27ab065ca404d7dc9e599023d14b00f5e8 commit 8496ed27ab065ca404d7dc9e599023d14b00f5e8 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-07-06 12:51:11 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-07-27 17:34:31 +0000 jaildesc: Publish the new fd only after the jaildesc is initialized jaildesc_alloc() finishes initializing the file structure only after it is made visible from the file descriptor table via finit(). In that window, other threads could try to perform operations on the descriptor and thus access an incompletely initialized jaildesc. Defer the finit() call until locks are initialized. While here, simplify the error path for falloc_caps(). Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai Reviewed by: jamie MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58049 (cherry picked from commit 38dd686b9336e2de5deadc5f8cb5e46a845b0dd9) --- sys/kern/kern_jaildesc.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/sys/kern/kern_jaildesc.c b/sys/kern/kern_jaildesc.c index d6a7649ec484..f8f396405284 100644 --- a/sys/kern/kern_jaildesc.c +++ b/sys/kern/kern_jaildesc.c @@ -129,18 +129,16 @@ jaildesc_alloc(struct thread *td, struct file **fpp, int *fdp, int owning) if (error != 0) return (error); } - jd = malloc(sizeof(*jd), M_JAILDESC, M_WAITOK | M_ZERO); error = falloc_caps(td, &fp, fdp, 0, NULL); - if (error != 0) { - free(jd, M_JAILDESC); + if (error != 0) return (error); - } - finit(fp, priv_check_cred(fp->f_cred, PRIV_JAIL_SET) == 0 ? - FREAD | FWRITE : FREAD, DTYPE_JAILDESC, jd, &jaildesc_ops); + jd = malloc(sizeof(*jd), M_JAILDESC, M_WAITOK | M_ZERO); JAILDESC_LOCK_INIT(jd); knlist_init_mtx(&jd->jd_selinfo.si_note, &jd->jd_lock); if (owning) jd->jd_flags |= JDF_OWNING; + finit(fp, priv_check_cred(fp->f_cred, PRIV_JAIL_SET) == 0 ? + FREAD | FWRITE : FREAD, DTYPE_JAILDESC, jd, &jaildesc_ops); *fpp = fp; return (0); }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a67ae27.36b6d.5b0edfe2>