From owner-svn-src-head@FreeBSD.ORG  Wed Feb 11 15:22:01 2009
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7F17A10656C5;
	Wed, 11 Feb 2009 15:22:01 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 6CCD08FC08;
	Wed, 11 Feb 2009 15:22:01 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n1BFM1ri029227;
	Wed, 11 Feb 2009 15:22:01 GMT (envelope-from rwatson@svn.freebsd.org)
Received: (from rwatson@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id n1BFM1H2029226;
	Wed, 11 Feb 2009 15:22:01 GMT (envelope-from rwatson@svn.freebsd.org)
Message-Id: <200902111522.n1BFM1H2029226@svn.freebsd.org>
From: Robert Watson <rwatson@FreeBSD.org>
Date: Wed, 11 Feb 2009 15:22:01 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r188485 - head/sys/kern
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
	<svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Feb 2009 15:22:02 -0000

Author: rwatson
Date: Wed Feb 11 15:22:01 2009
New Revision: 188485
URL: http://svn.freebsd.org/changeset/base/188485

Log:
  Modify fdcopy() so that, during fork(2), it won't copy file descriptors
  from the parent to the child process if they have an operation vector
  of &badfileops.  This narrows a set of races involving system calls that
  allocate a new file descriptor, potentially block for some extended
  period, and then return the file descriptor, when invoked by a threaded
  program that concurrently invokes fork(2).  Similar approches are used
  in both Solaris and Linux, and the wideness of this race was introduced
  in FreeBSD when we moved to a more optimistic implementation of
  accept(2) in order to simplify locking.
  
  A small race necessarily remains because the fork(2) might occur after
  the finit() in accept(2) but before the system call has returned, but
  that appears unavoidable using current APIs.  However, this race is
  vastly narrower.
  
  The fix can be validated using the newfileops_on_fork regression test.
  
  PR:		kern/130348
  Reported by:	Ivan Shcheklein <shcheklein at gmail dot com>
  Reviewed by:	jhb, kib
  MFC after:	1 week

Modified:
  head/sys/kern/kern_descrip.c

Modified: head/sys/kern/kern_descrip.c
==============================================================================
--- head/sys/kern/kern_descrip.c	Wed Feb 11 14:25:09 2009	(r188484)
+++ head/sys/kern/kern_descrip.c	Wed Feb 11 15:22:01 2009	(r188485)
@@ -1583,7 +1583,8 @@ fdcopy(struct filedesc *fdp)
 	newfdp->fd_freefile = -1;
 	for (i = 0; i <= fdp->fd_lastfile; ++i) {
 		if (fdisused(fdp, i) &&
-		    fdp->fd_ofiles[i]->f_type != DTYPE_KQUEUE) {
+		    fdp->fd_ofiles[i]->f_type != DTYPE_KQUEUE &&
+		    fdp->fd_ofiles[i]->f_ops != &badfileops) {
 			newfdp->fd_ofiles[i] = fdp->fd_ofiles[i];
 			newfdp->fd_ofileflags[i] = fdp->fd_ofileflags[i];
 			fhold(newfdp->fd_ofiles[i]);