Date: Sun, 5 Oct 2014 20:14:58 +0300 From: Konstantin Belousov <kostikbel@gmail.com> To: Mateusz Guzik <mjguzik@gmail.com>, freebsd-hackers@freebsd.org Subject: Re: fork: hold newly created processes Message-ID: <20141005171457.GA26076@kib.kiev.ua> In-Reply-To: <20141005102912.GB9262@dft-labs.eu> References: <20141005102912.GB9262@dft-labs.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Oct 05, 2014 at 12:29:12PM +0200, Mateusz Guzik wrote: > fork: hold newly created processes > > Consumers of fork1 -> do_fork receive new proc pointer, but nothing > guarnatees its stability at that time. > > New process could already exit and be waited for, in which case we get a > use after free. Since the new process is the child of the current process, it can happen only if the code is self-inflicting. I can imagine that the only way to achieve it, do wait() in other thread. That said, there is no harm for the kernel state, since struct proc is type-stable, so we do not dereference a random memory, do you agree ? We could return non-existing or reused pid, but this can occur with your patch as well, since the same exit/wait could be done while forking thread executes syscall return code.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20141005171457.GA26076>