svn commit: r184924 - in stable/7/sys: . compat/linux modules/cxgb

[Konstantin Belousov]

Author: kib
Date: Thu Nov 13 15:00:40 2008
New Revision: 184924
URL: http://svn.freebsd.org/changeset/base/184924

Log:
  MFC r184501:
  The code in linux_proc_exit() contains a race when multiple linux based
  processes exits at the same time. The linux_emuldata structure is freed
  but p->p_emuldata is left as a dangling pointer to the just freed
  memory.
  
  The check for W_EXIT in the loop scanning the child processes isn't safe
  since the state of the child process can change right afterwards. Lock
  the process and check the W_EXIT before delivering signal.
  
  Approved by:	re (kensmith)

Modified:
  stable/7/sys/   (props changed)
  stable/7/sys/compat/linux/linux_emul.c
  stable/7/sys/modules/cxgb/   (props changed)

Modified: stable/7/sys/compat/linux/linux_emul.c
==============================================================================
--- stable/7/sys/compat/linux/linux_emul.c	Thu Nov 13 15:00:34 2008	(r184923)
+++ stable/7/sys/compat/linux/linux_emul.c	Thu Nov 13 15:00:40 2008	(r184924)
@@ -232,11 +232,11 @@ linux_proc_exit(void *arg __unused, stru
 			continue;
 		em = em_find(q, EMUL_DOLOCK);
 		KASSERT(em != NULL, ("linux_reparent: emuldata not found: %i\n", q->p_pid));
-		if (em->pdeath_signal != 0) {
-			PROC_LOCK(q);
+		PROC_LOCK(q);
+		if ((q->p_flag & P_WEXIT) == 0 && em->pdeath_signal != 0) {
 			psignal(q, em->pdeath_signal);
-			PROC_UNLOCK(q);
 		}
+		PROC_UNLOCK(q);
 		EMUL_UNLOCK(&emul_lock);
 	}
 	sx_xunlock(&proctree_lock);