Date: Sun, 28 Dec 2003 18:05:36 +0000 From: David Malone <dwmalone@maths.tcd.ie> To: freebsd-current@freebsd.org Subject: Re: file descriptor leak in 5.2-RC Message-ID: <20031228180536.GA49762@walton.maths.tcd.ie> In-Reply-To: <20031228001529.GQ86308@e-Gitt.NET> References: <20031227205000.GG86308@e-Gitt.NET> <1035.1072561906@critter.freebsd.dk> <20031228001529.GQ86308@e-Gitt.NET>
next in thread | previous in thread | raw e-mail | index | archive | help
> I'd call it a surprise if someone after all had a fix within the next 10
> hours or so.
I'm fairly certain I've found the problem (and, indeed, it looks
like I introduced it too while changing how falloc works). You loose
a reference to /dev/null every time you exec a suid program with
at least one of std{in,out,err} closed. I'm guessing that some part
of postfix does this.
I believe the patch below will fix the problem. I guess I'm too
late for you to test it now?
David.
Index: kern_descrip.c
===================================================================
RCS file: /cvs/FreeBSD-CVS/src/sys/kern/kern_descrip.c,v
retrieving revision 1.215
diff -u -r1.215 kern_descrip.c
--- kern_descrip.c 19 Oct 2003 20:41:06 -0000 1.215
+++ kern_descrip.c 28 Dec 2003 17:55:00 -0000
@@ -1730,6 +1730,7 @@
fp->f_type = DTYPE_VNODE;
VOP_UNLOCK(nd.ni_vp, 0, td);
devnull = fd;
+ fdrop(fp, td);
} else {
error = do_dup(td, DUP_FIXED, devnull, i, &retval);
if (error != 0)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031228180536.GA49762>