fork: hold newly created processes
Konstantin Belousov
kostikbel at gmail.com
Sun Oct 5 17:15:03 UTC 2014
On Sun, Oct 05, 2014 at 12:29:12PM +0200, Mateusz Guzik wrote:
> fork: hold newly created processes
>
> Consumers of fork1 -> do_fork receive new proc pointer, but nothing
> guarnatees its stability at that time.
>
> New process could already exit and be waited for, in which case we get a
> use after free.
Since the new process is the child of the current process, it can happen
only if the code is self-inflicting. I can imagine that the only way
to achieve it, do wait() in other thread.
That said, there is no harm for the kernel state, since struct proc is
type-stable, so we do not dereference a random memory, do you agree ?
We could return non-existing or reused pid, but this can occur with
your patch as well, since the same exit/wait could be done while forking
thread executes syscall return code.
More information about the freebsd-hackers
mailing list