lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-12-24 17:51:17 +03:00
Code Activity

posix: Fix pidfd_spawn/pidfd_spawnp leak if execve fails (BZ 31695)

Browse Source 
If the pidfd_spawn/pidfd_spawnp helper process succeeds, but evecve
fails for some reason (either with an invalid/non-existent, memory
allocation, etc.) the resulting pidfd is never closed, nor returned
to caller (so it can call close).

Since the process creation failed, it should be up to posix_spawn to
also, close the file descriptor in this case (similar to what it
does to reap the process).

This patch also changes the waitpid with waitid (P_PIDFD) for pidfd
case, to avoid a possible pid re-use.

Checked on x86_64-linux-gnu.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
This commit is contained in:
Adhemerval Zanella
2024-05-06 13:20:56 -03:00
parent 17a293c5fa
commit c90cfce849
2 changed files with 58 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
sysdeps/unix/sysv/linux/spawni.c
View File

@@ -449,13 +449,22 @@ __spawnix (int *pid, const char *file,
caller to actually collect it. */
ec = args.err;
if (ec > 0)
/* There still an unlikely case where the child is cancelled after
setting args.err, due to a positive error value. Also there is
possible pid reuse race (where the kernel allocated the same pid
to an unrelated process). Unfortunately due synchronization
issues where the kernel might not have the process collected
the waitpid below can not use WNOHANG. */
__waitpid (new_pid, NULL, 0);
{
/* There still an unlikely case where the child is cancelled after
setting args.err, due to a positive error value. Also there is
possible pid reuse race (where the kernel allocated the same pid
to an unrelated process). Unfortunately due synchronization
issues where the kernel might not have the process collected
the waitpid below can not use WNOHANG. */
__waitid (use_pidfd ? P_PIDFD : P_PID,
use_pidfd ? args.pidfd : new_pid,
NULL,
WEXITED);
/* For pidfd we need to also close the file descriptor for the case
where execve fails. */
if (use_pidfd)
__close_nocancel_nostatus (args.pidfd);
}
}
else
ec = errno;