Race in pipe tear-down, perhaps kqueue-related? (was: Re: Fatal trap , 12: page fault in kern/kern_mutex.c:744)

Mike Silbersack silby at silby.com
Fri Nov 12 09:10:14 PST 2004


On Fri, 12 Nov 2004, Robert Watson wrote:

> This looks like a bug in the pipe code where-in a partially initialized
> pipe is free'd due to memory allocation problems (hitting a resource
> limit).  pipeclose() is called when pipe_create() fails on one of the two
> pipe endpoints, but it looks like pipeclose() is unprepared for the
> eventuality that this is the case, as it attempts to generate wakeup
> events on the pipe endpoint using pipeselwakeup(), which is not the right
> thing to do while the pipe is not yet initialized.  Maybe we need a
> special pipeclose() tear-down path that doesn't assume the pipe has
> already been fully initialized?
>
> Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
> robert at fledge.watson.org      Principal Research Scientist, McAfee Research

I'll take a look into this over the weekend.

Mike "Silby" Silbersack


More information about the freebsd-current mailing list