Author: kib
Date: Fri Oct 31 10:38:30 2008
New Revision: 184501
URL: http://svn.freebsd.org/changeset/base/184501
Log:
The code in linux_proc_exit() contains a race when multiple linux based
processes exits at the same time. The linux_emuldata structure is freed
but p->p_emuldata is left as a dangling pointer to the just freed memory.
The check for W_EXIT in the loop scanning the child processes isn't safe
since the state of the child process can change right afterwards. Lock
the process and check the W_EXIT before delivering signal.
Submitted by: tegge
Reviewed by: davidxu
MFC after: 1 week
Modified:
head/sys/compat/linux/linux_emul.c
Modified: head/sys/compat/linux/linux_emul.c
==============================================================================
--- head/sys/compat/linux/linux_emul.c Fri Oct 31 10:14:28 2008
(r184500)
+++ head/sys/compat/linux/linux_emul.c Fri Oct 31 10:38:30 2008
(r184501)
@@ -235,11 +235,11 @@ linux_proc_exit(void *arg __unused, stru
continue;
em = em_find(q, EMUL_DOLOCK);
KASSERT(em != NULL, ("linux_reparent: emuldata not found:
%i\n", q->p_pid));
- if (em->pdeath_signal != 0) {
- PROC_LOCK(q);
+ PROC_LOCK(q);
+ if ((q->p_flag & P_WEXIT) == 0 && em->pdeath_signal != 0) {
psignal(q, em->pdeath_signal);
- PROC_UNLOCK(q);
}
+ PROC_UNLOCK(q);
EMUL_UNLOCK(&emul_lock);
}
sx_xunlock(&proctree_lock);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
