diff options
author | mjg <mjg@FreeBSD.org> | 2014-03-31 02:44:43 +0000 |
---|---|---|
committer | mjg <mjg@FreeBSD.org> | 2014-03-31 02:44:43 +0000 |
commit | e7b96c1d34456762279db22270b51e022347b212 (patch) | |
tree | e6690d2583d69f8adec4e13b1cbf22dba6e35c88 | |
parent | 0cdb222abb2eb4b31d60ed30588dc41c5240527b (diff) | |
download | FreeBSD-src-e7b96c1d34456762279db22270b51e022347b212.zip FreeBSD-src-e7b96c1d34456762279db22270b51e022347b212.tar.gz |
MFC r263755:
Document a known problem with handling the process intended to receive
SIGIO in /dev/devctl.
-rw-r--r-- | sys/kern/subr_bus.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c index 8f41cd5..2061449 100644 --- a/sys/kern/subr_bus.c +++ b/sys/kern/subr_bus.c @@ -497,6 +497,21 @@ devioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, struct thread *t devsoftc.nonblock = 0; return (0); case FIOASYNC: + /* + * FIXME: + * Since this is a simple assignment there is no guarantee that + * devsoftc.async_proc consumers will get a valid pointer. + * + * Example scenario where things break (processes A and B): + * 1. A opens devctl + * 2. A sends fd to B + * 3. B sets itself as async_proc + * 4. B exits + * + * However, normally this requires root privileges and the only + * in-tree consumer does not behave in a dangerous way so the + * issue is not critical. + */ if (*(int*)data) devsoftc.async_proc = td->td_proc; else @@ -582,6 +597,7 @@ devctl_queue_data_f(char *data, int flags) cv_broadcast(&devsoftc.cv); mtx_unlock(&devsoftc.mtx); selwakeup(&devsoftc.sel); + /* XXX see a comment in devioctl */ p = devsoftc.async_proc; if (p != NULL) { PROC_LOCK(p); |