HomeFreeBSD

Plug a race between fd table teardown and several loops

Description

Plug a race between fd table teardown and several loops

To export information from fd tables we have several loops which do
this:

FILDESC_SLOCK(fdp);
for (i = 0; fdp->fd_refcount > 0 && i <= lastfile; i++)
<export info for fd i>;
FILDESC_SUNLOCK(fdp);

Before r367777, fdescfree() acquired the fd table exclusive lock between
decrementing fdp->fd_refcount and freeing table entries. This
serialized with the loop above, so the file at descriptor i would remain
valid until the lock is dropped. Now there is no serialization, so the
loops may race with teardown of file descriptor tables.

Acquire the exclusive fdtable lock after releasing the final table
reference to provide a barrier synchronizing with these loops.

Reported by: pho
Reviewed by: kib (previous version), mjg
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D27513

Details

Provenance
markjAuthored on
Reviewer
kib
Differential Revision
D27513: fd: Plug a race between fd table free and several loops
Parents
rS368485: Use refcount_load(9) to load fd table reference counts
Branches
Unknown
Tags
Unknown