Page MenuHomeFreeBSD

kqueue: on process exit, force-clear its registered signal events
ClosedPublic

Authored by kib on Nov 24 2023, 6:47 AM.
Tags
None
Referenced Files
F132677543: D42745.id130495.diff
Sat, Oct 18, 11:47 PM
Unknown Object (File)
Tue, Oct 14, 4:25 AM
Unknown Object (File)
Tue, Oct 14, 4:25 AM
Unknown Object (File)
Tue, Oct 14, 4:25 AM
Unknown Object (File)
Mon, Oct 13, 3:02 PM
Unknown Object (File)
Sun, Oct 12, 3:33 AM
Unknown Object (File)
Wed, Oct 1, 4:20 AM
Unknown Object (File)
Sat, Sep 27, 1:23 PM
Subscribers

Details

Summary
Normally, process already has all its kqueue fds destroyed at the moment
p_klist is detached in exit flow. But, if the process was created with
rfork(2) with shared file descriptors, its signal knotes can survive.
Then, knlist_detach() does not destroy non-empty knlist. Later, when
owning kqueue is closed, we access freed (or rather, reused, because
struct proc is type-stable) memory by referencing p->p_klist from such
knote.

Handle this situation by deleting all knotes hanging from p_klist.

PR:     275286

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable