From nobody Tue Sep 29 15:59:58 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvNDH1l22z6tlKD for ; Tue, 29 Sep 2026 15:59:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvNDH0kPKz4gqy for ; Tue, 29 Sep 2026 15:59:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790697599; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Kjg583plS9aJ11wuqqWp1n0uQwwMdSD4fz8KKdYYDWc=; b=Hb2l4x3PZIfo+J89oN2QW0nd8M9uX68T2bE/yB2A5VwHbRLnHQBuSy4UD5J8/afNJlAQkE SgmBXMbcdb+7CJgf9LqNzZC+JGWvsfUKu69qGQbxMigX+Jd9rf1cAQQXTAhom48qNOfoET Hehr5FeQga3WCjL9tPhVxQjm350lQyNxoG+n9LHCIpJyjeWrwCAFwzH7w/NvUCo8TrakoN /+mX7Mv+s8s08bFU2lu29jxQRmRRTfVsVleNF5iEuIKQxYWtBcZol3Vs4M4kSb7MSzU+8J fQIrsDi/zO4VypkrDjEm7E4G3XhZ9TNSJM9NfNxPGaqWGesRZm72MuS3cS4znA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790697599; b=RYUivrJ8RU802ZRB/CqxkdQuP8PFChWENDxg0XH88drO2XlIgWuR7XtrUwRNk4kddYPzLR da0UqNpYxhqPZt8Up8DsQFviqSKMmsgpbM/wrG5LqlVp1tUcJqwCnO4NwpMjbhvzpHSU2A tvzEpKZleZ58E19PsQVx/vPwXGuQQ0ZZ756XF3AM+zu+gibVnnEyxGwPaO+mCq5rFQdIO9 BlGCGz6EaKRVz6e2cbSMU91mH1u7qxerOF7LXv4Px2TLOVEJKCggagp0vGKrpaen8YQKl0 P3F2zlBhdU6v/ekaEWVxpvILWixQnTNQyIBwoBt77Kh+SIasgAdYVGYxf6pJCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790697599; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Kjg583plS9aJ11wuqqWp1n0uQwwMdSD4fz8KKdYYDWc=; b=cdepnFlDEzWEsQgsJMvvqXQ5+B/HQOAhuYRjNP/w+mUcFWGNsWdBXNaiV1ou5ZMDfjd4sD b7VGga9mdnqEy3UtLyJ0x7Vnz1arTdmHJhYU4zLo4vCN+jk7FbQL7ukqEldZlUAUIy9P5u JwYooVDPsZNhemAO/Xc3ebzdY+1bSYG6g/cMd2oA6wqy4S7ZqnFro4MkVapCfjNwNoM6it DuRVazuA+8pKpAEXVGHrJdDaAzizRpy8uBziMm7GKnWM4O45W7RojUi9CGtc3jjeW1+oBx pungvLhAvmHNNYR+F5dJd6DPbWOXAKxL8tVNsmDf89mbzhlIAKqW66CIANiFxA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvNDG60hCz1KVQ for ; Tue, 29 Sep 2026 15:59:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30242 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 15:59:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Baptiste Daroussin From: Mark Johnston Subject: git: c895c72120e2 - releng/15.1 - syslogd: reap pipe children on config reload List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: c895c72120e24c69447676d20d35df9544d2d89e Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 15:59:58 +0000 Message-Id: <6abbe07e.30242.2e502202@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c895c72120e24c69447676d20d35df9544d2d89e commit c895c72120e24c69447676d20d35df9544d2d89e Author: Baptiste Daroussin AuthorDate: 2026-09-02 08:51:42 +0000 Commit: Mark Johnston CommitDate: 2026-09-28 13:10:19 +0000 syslogd: reap pipe children on config reload On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its pipe process is still running. close_filed() sets f_type to F_UNUSED before the check, so the condition f_type != F_PIPE is always true and the filed is freed while its process descriptor is still on the dead queue and registered in the kqueue. When the child later exits, the NOTE_EXIT handler dereferences the freed filed (use-after-free) and never closes the process descriptor, leaving the pipe child as a persistent zombie. Capture whether the filed is a pipe with an active process descriptor before calling close_filed(), and defer the free in that case so the NOTE_EXIT handler can reap the child and free the filed. Approved by: so Security: FreeBSD-EN-26:23.syslogd Reviewed by: markj Fixes: 95381c0139d6 (syslogd: Use process descriptors) Differential Revision: https://reviews.freebsd.org/D59319 (cherry picked from commit 1a669b66ddb4748c24116e32dcb51eabaf4859ed) (cherry picked from commit 8cf005884326fd15324bc484867c0a947607cb45) --- usr.sbin/syslogd/syslogd.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c index ee15fa70807d..515441ea2411 100644 --- a/usr.sbin/syslogd/syslogd.c +++ b/usr.sbin/syslogd/syslogd.c @@ -2495,6 +2495,7 @@ void closelogfiles(void) { struct filed *f; + bool defer_free; while (!STAILQ_EMPTY(&fhead)) { f = STAILQ_FIRST(&fhead); @@ -2504,6 +2505,13 @@ closelogfiles(void) if (f->f_prevcount) fprintlog_successive(f, 0); + /* + * If a piped process is running, then defer the filed + * cleanup until it exits. close_filed() below sets + * f_type to F_UNUSED, so capture this before calling it. + */ + defer_free = (f->f_type == F_PIPE && f->f_procdesc != -1); + switch (f->f_type) { case F_FILE: case F_FORW: @@ -2531,11 +2539,7 @@ closelogfiles(void) free(f->f_prop_filter); } - /* - * If a piped process is running, then defer the filed - * cleanup until it exits. - */ - if (f->f_type != F_PIPE || f->f_procdesc == -1) + if (!defer_free) free(f); } }