Page MenuHomeFreeBSD

syslogd: reap pipe children on config reload
ClosedPublic

Authored by bapt on Wed, Sep 2, 8:56 AM.
Tags
None
Referenced Files
F169822605: D59319.id185615.diff
Wed, Sep 2, 4:29 PM
F169822097: D59319.diff
Wed, Sep 2, 4:27 PM
F169795312: D59319.diff
Wed, Sep 2, 2:31 PM
F169791147: D59319.diff
Wed, Sep 2, 2:10 PM
F169773309: D59319.id185615.diff
Wed, Sep 2, 12:53 PM
F169770042: D59319.id.diff
Wed, Sep 2, 12:36 PM
F169764042: D59319.diff
Wed, Sep 2, 12:09 PM
Subscribers

Details

Summary

On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running. close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue. When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.

Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.

Test Plan

with

*.info         |exec /home/bapt/zombies.sh

the script being

#!/bin/sh
while read -r line; do
    :
done

We ensure the script is spawned:
logger -p info -t test "spawn"
pkill -HUP syslogd

here you are you have your zombies

restart syslogd, they are reaped properly.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bapt requested review of this revision.Wed, Sep 2, 8:56 AM
bapt added a reviewer: markj.

I wrote a regression test case for this bug, will commit it after this patch lands.

Could you please add a Fixes tag to the commit log?

This revision is now accepted and ready to land.Wed, Sep 2, 2:32 PM
This revision was automatically updated to reflect the committed changes.