Page MenuHomeFreeBSD

Fix some EVFILT_PROC-related race conditions.
ClosedPublic

Authored by markj on Nov 23 2018, 9:58 PM.
Tags
None
Referenced Files
F108499207: D18316.diff
Sat, Jan 25, 3:33 PM
Unknown Object (File)
Sat, Jan 18, 5:18 PM
Unknown Object (File)
Wed, Jan 15, 10:32 AM
Unknown Object (File)
Tue, Jan 14, 3:58 PM
Unknown Object (File)
Sun, Jan 12, 12:23 PM
Unknown Object (File)
Oct 21 2024, 7:57 AM
Unknown Object (File)
Sep 23 2024, 6:42 AM
Unknown Object (File)
Sep 16 2024, 4:14 PM
Subscribers

Details

Summary

knote_fork() may attempt to register an event after we have started to
close a kqueue. Check for KQ_CLOSING with the kqueue lock held before
resizing the fd table or creating a knote hash table, and before
inserting a new knote into one of the kqueue tables.

In knote_fork(), acquire the knlist lock before dropping the kqueue lock
and the in-flux state of the knote. Otherwise there is nothing
preventing the knote from being freed before the knlist lock is
reacquired. I believe the in-flux state is sufficient to prevent the
knote from being removed from the knlist while locks are dropped.

When initializing the kqueue hash table, respect the "waitok" parameter;
hashinit() uses M_WAITOK.

Test Plan

I asked Peter to test the patch. His kevent12.sh triggers these races.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj added a reviewer: kib.
sys/kern/kern_event.c
1744 ↗(On Diff #51022)

Commit this part (honor waitok) separately ?

This revision was not accepted when it landed; it landed in state Needs Review.Nov 23 2018, 11:10 PM
This revision was automatically updated to reflect the committed changes.
markj marked an inline comment as done.
kib added inline comments.
sys/kern/kern_event.c
606 ↗(On Diff #51028)

This chunk deserves separate commit IMO.

This revision is now accepted and ready to land.Nov 23 2018, 11:43 PM
This revision was automatically updated to reflect the committed changes.