mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-13 10:02:38 +00:00
Code Issues Releases Activity

The code in linux_proc_exit() contains a race when multiple linux based

Browse Source 
processes exits at the same time.  The linux_emuldata structure is freed
but p->p_emuldata is left as a dangling pointer to the just freed memory.

The check for W_EXIT in the loop scanning the child processes isn't safe
since the state of the child process can change right afterwards. Lock
the process and check the W_EXIT before delivering signal.

Submitted by:	tegge
Reviewed by:	davidxu
MFC after:	1 week
This commit is contained in:
Konstantin Belousov 2008-10-31 10:38:30 +00:00
parent d1237d3f72
commit 17b9edd35a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=184501
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/compat/linux/linux_emul.c
View File

@ -235,11 +235,11 @@ linux_proc_exit(void *arg __unused, struct proc *p)
continue;
em = em_find(q, EMUL_DOLOCK);
KASSERT(em != NULL, ("linux_reparent: emuldata not found: %i\n", q->p_pid));
if (em->pdeath_signal != 0) {
PROC_LOCK(q);
PROC_LOCK(q);
if ((q->p_flag & P_WEXIT) == 0 && em->pdeath_signal != 0) {
psignal(q, em->pdeath_signal);
PROC_UNLOCK(q);
}
PROC_UNLOCK(q);
EMUL_UNLOCK(&emul_lock);
}
sx_xunlock(&proctree_lock);