mqueue,ksem,shm: Fix race condition with setting UF_EXCLOSE.

POSIX mqueue, compatibility ksem and POSIX shm create a file descriptor that
has close-on-exec set. However, they do this incorrectly, leaving a window
where a thread may fork and exec while the flag has not been set yet. The
race is easily reproduced on a multicore system with one thread doing
shm_open and close and another thread doing posix_spawnp and waitpid.

Set UF_EXCLOSE via falloc()'s flags argument instead. This also simplifies
the code.

MFC after:	1 week

1 files changed, 1 insertions, 5 deletions

diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c
index fc33de5..7a36a63 100644
--- a/sys/kern/uipc_shm.c
+++ b/sys/kern/uipc_shm.c
@@ -534,7 +534,7 @@ sys_shm_open(struct thread *td, struct shm_open_args *uap)
 	fdp = td->td_proc->p_fd;
 	cmode = (uap->mode & ~fdp->fd_cmask) & ACCESSPERMS;
 
-	error = falloc(td, &fp, &fd, 0);
+	error = falloc(td, &fp, &fd, O_CLOEXEC);
 	if (error)
 		return (error);
 
@@ -629,10 +629,6 @@ sys_shm_open(struct thread *td, struct shm_open_args *uap)
 
 	finit(fp, FFLAGS(uap->flags & O_ACCMODE), DTYPE_SHM, shmfd, &shm_ops);
 
-	FILEDESC_XLOCK(fdp);
-	if (fdp->fd_ofiles[fd].fde_file == fp)
-		fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE;
-	FILEDESC_XUNLOCK(fdp);
 	td->td_retval[0] = fd;
 	fdrop(fp, td);