HomeFreeBSD

syslogd: reap pipe children on config reload

Description

syslogd: reap pipe children on config reload

On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running. close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue. When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.

Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.

Reviewed by: markj
Fixes: 95381c0139d6 (syslogd: Use process descriptors)
Differential Revision: https://reviews.freebsd.org/D59319

Details

Provenance
baptAuthored on Wed, Sep 2, 8:51 AM
Reviewer
rG95381c0139d6: syslogd: Use process descriptors
Differential Revision
D59319: syslogd: reap pipe children on config reload
Parents
rGab420c44bc7c: libc: Add PRIb*, PRIB*, and SCNb* macros as per C23
Branches
Unknown
Tags
Unknown