Date: Thu, 13 Nov 2008 15:00:40 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org Subject: svn commit: r184924 - in stable/7/sys: . compat/linux modules/cxgb Message-ID: <200811131500.mADF0esO061783@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Thu Nov 13 15:00:40 2008 New Revision: 184924 URL: http://svn.freebsd.org/changeset/base/184924 Log: MFC r184501: The code in linux_proc_exit() contains a race when multiple linux based processes exits at the same time. The linux_emuldata structure is freed but p->p_emuldata is left as a dangling pointer to the just freed memory. The check for W_EXIT in the loop scanning the child processes isn't safe since the state of the child process can change right afterwards. Lock the process and check the W_EXIT before delivering signal. Approved by: re (kensmith) Modified: stable/7/sys/ (props changed) stable/7/sys/compat/linux/linux_emul.c stable/7/sys/modules/cxgb/ (props changed) Modified: stable/7/sys/compat/linux/linux_emul.c ============================================================================== --- stable/7/sys/compat/linux/linux_emul.c Thu Nov 13 15:00:34 2008 (r184923) +++ stable/7/sys/compat/linux/linux_emul.c Thu Nov 13 15:00:40 2008 (r184924) @@ -232,11 +232,11 @@ linux_proc_exit(void *arg __unused, stru continue; em = em_find(q, EMUL_DOLOCK); KASSERT(em != NULL, ("linux_reparent: emuldata not found: %i\n", q->p_pid)); - if (em->pdeath_signal != 0) { - PROC_LOCK(q); + PROC_LOCK(q); + if ((q->p_flag & P_WEXIT) == 0 && em->pdeath_signal != 0) { psignal(q, em->pdeath_signal); - PROC_UNLOCK(q); } + PROC_UNLOCK(q); EMUL_UNLOCK(&emul_lock); } sx_xunlock(&proctree_lock);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200811131500.mADF0esO061783>