diff options
| author | rwatson <rwatson@FreeBSD.org> | 2004-11-23 22:15:08 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2004-11-23 22:15:08 +0000 |
| commit | 278f52e7a7437df96f1c2a2f1513356a05dcc7dc (patch) | |
| tree | 6aec7035a982e1002ebf2c9544b9c9579506434d /sys/kern/sys_pipe.c | |
| parent | e0cb9607c5e7ba4f51e46e1fd4248f9058e1fa0b (diff) | |
| download | FreeBSD-src-278f52e7a7437df96f1c2a2f1513356a05dcc7dc.zip FreeBSD-src-278f52e7a7437df96f1c2a2f1513356a05dcc7dc.tar.gz | |
Correct a bug introduced in sys_pipe.c:1.179: in pipe_ioctl(),
release the pipe mutex before calling fsetown(), as fsetown()
may block. The sigio code protects the pipe sigio data using
its own mutex, and the pipe reference count held by the caller
will prevent the pipe from being prematurely garbage-collected.
Discovered by: imp
Diffstat (limited to 'sys/kern/sys_pipe.c')
| -rw-r--r-- | sys/kern/sys_pipe.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c index 16af809..e8468d4 100644 --- a/sys/kern/sys_pipe.c +++ b/sys/kern/sys_pipe.c @@ -1292,8 +1292,9 @@ pipe_ioctl(fp, cmd, data, active_cred, td) break; case FIOSETOWN: + PIPE_UNLOCK(mpipe); error = fsetown(*(int *)data, &mpipe->pipe_sigio); - break; + goto out_unlocked; case FIOGETOWN: *(int *)data = fgetown(&mpipe->pipe_sigio); @@ -1301,8 +1302,9 @@ pipe_ioctl(fp, cmd, data, active_cred, td) /* This is deprecated, FIOSETOWN should be used instead. */ case TIOCSPGRP: + PIPE_UNLOCK(mpipe); error = fsetown(-(*(int *)data), &mpipe->pipe_sigio); - break; + goto out_unlocked; /* This is deprecated, FIOGETOWN should be used instead. */ case TIOCGPGRP: @@ -1314,6 +1316,7 @@ pipe_ioctl(fp, cmd, data, active_cred, td) break; } PIPE_UNLOCK(mpipe); +out_unlocked: return (error); } |
