diff options
| author | dillon <dillon@FreeBSD.org> | 2003-01-13 23:04:32 +0000 |
|---|---|---|
| committer | dillon <dillon@FreeBSD.org> | 2003-01-13 23:04:32 +0000 |
| commit | ce710d36cc14755344115d36e5459a39e385e64d (patch) | |
| tree | 3c875a6ad9627d4125943a71834883e1b354baa5 /sys/kern/sysv_ipc.c | |
| parent | e08a8297e2779e8d6e2160c041440e8f3908ece8 (diff) | |
| download | FreeBSD-src-ce710d36cc14755344115d36e5459a39e385e64d.zip FreeBSD-src-ce710d36cc14755344115d36e5459a39e385e64d.tar.gz | |
It is possible for an active aio to prevent shared memory from being
dereferenced when a process exits due to the vmspace ref-count being
bumped. Change shmexit() and shmexit_myhook() to take a vmspace instead
of a process and call it in vmspace_dofree(). This way if it is missed
in exit1()'s early-resource-free it will still be caught when the zombie is
reaped.
Also fix a potential race in shmexit_myhook() by NULLing out
vmspace->vm_shm prior to calling shm_delete_mapping() and free().
MFC after: 7 days
Diffstat (limited to 'sys/kern/sysv_ipc.c')
| -rw-r--r-- | sys/kern/sysv_ipc.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/sys/kern/sysv_ipc.c b/sys/kern/sysv_ipc.c index fc5fd8f..55d39de 100644 --- a/sys/kern/sysv_ipc.c +++ b/sys/kern/sysv_ipc.c @@ -42,7 +42,7 @@ #include <sys/ucred.h> void (*shmfork_hook)(struct proc *, struct proc *) = NULL; -void (*shmexit_hook)(struct proc *) = NULL; +void (*shmexit_hook)(struct vmspace *) = NULL; /* called from kern_fork.c */ void @@ -57,12 +57,11 @@ shmfork(p1, p2) /* called from kern_exit.c */ void -shmexit(p) - struct proc *p; +shmexit(struct vmspace *vm) { if (shmexit_hook != NULL) - shmexit_hook(p); + shmexit_hook(vm); return; } |
