From e42ccf8d79ffa7c3eab7b0edc9826a39595da584 Mon Sep 17 00:00:00 2001 From: dwmalone Date: Mon, 8 Jan 2001 22:14:48 +0000 Subject: If we failed to allocate the file discriptor for the write end of the pipe, then we were corrupting the pipe_zone free list by calling pipeclose on rpipe twice. NULL out rpipe to avoid this. Reviewed by: dillon Reviewed by: iedowse --- sys/kern/sys_pipe.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'sys/kern/sys_pipe.c') diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c index 4c505e7..3b944dd 100644 --- a/sys/kern/sys_pipe.c +++ b/sys/kern/sys_pipe.c @@ -182,6 +182,12 @@ pipe(p, uap) pipeinit(wpipe); wpipe->pipe_state |= PIPE_DIRECTOK; + /* + * Warning: once we've gotten past allocation of the fd for the + * read-side, we can only drop the read side via fdrop() in order + * to avoid races against processes which manage to dup() the read + * side while we are blocked trying to allocate the write side. + */ error = falloc(p, &rf, &fd); if (error) goto free2; @@ -211,6 +217,8 @@ free3: fdrop(rf, p); } fdrop(rf, p); + /* rpipe has been closed by fdrop() */ + rpipe = NULL; free2: (void)pipeclose(wpipe); (void)pipeclose(rpipe); -- cgit v1.1