From nobody Wed Sep 02 15:01:03 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hZmBm18QVz6qBm2 for ; Wed, 02 Sep 2026 15:01:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hZmBm06Z5z3ZtT for ; Wed, 02 Sep 2026 15:01:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788361264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5Ek5gsAjXvIJYo6pRCUCqMd81qw8CaQSgQylmJuHQ2A=; b=g8Gdu8Hoop8LXyrymZt7pbc9Z7XYjTTkgw1ARssUwGwMitqnuNwFvx+fHlyF/ce4Cq88Dx pZ2bggkt1Xv0F8LgSYiU/SYXBY0+B3HsmE6n60NsXEPGUY9K4Mj7lMh69bu+z0t1PdHi40 W0f29qiZPxF6Ok53t1ouNk3cWS8DZXMon3WsyRe834tJBX//ydXgtdhPfWb9GtRCbC4PNa qkcjC9QNY2X+bJKQR0NVFXn5qX34yCSwvhuuD/0GEwj/vWnAvlB1RUwiVlDQdBXEiJ7otc /JtAF2YTeoCEZ/Z9d+RHf42MDlajNwJVqvH7dqzSzw5L7EONVd0RsgQlJhFw2w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788361264; a=rsa-sha256; cv=none; b=ubREFTxX2fP3dvqbekeIZ6OPVdl6H0Ja1VIrZeEh5WK9g/Sv8aEHNNKxYSc1G6tMtkWElq eDe/GHZ78nP4Ex1Flm5WQ94I9jRYdRyS9VHwWh3q3EuqsvKFEFBtWouhFf2nh2Spy68It3 ttX0+hZuP025MM9WCxhgtX5XFoCJHq1Jbdkle9tSKk6JEhJDqgVfYECI8/DX2F5WRmMybN XFccOdZu112njQPgx3ewfdWkkuewQU/W7NP95AEkyKxvtHEplqkmIlCOGSOxuDwsJ5MEi9 fPjH+dOwEqp/DzmWDDEy3fkLEQWJUeDLzbTv1VG2g0HXGJFixO0h/phH9tLFNg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788361264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5Ek5gsAjXvIJYo6pRCUCqMd81qw8CaQSgQylmJuHQ2A=; b=mM419/tNutmFX23GbFYKkOw6sRjE4/bPdXSC1ciRycVnahUbFzz+/arA6BuyERko41IqYY ai/EhxMuoFhLr4vFRVwW63iphmgjkVjt5HVDkVPS5LWmyjU9rQY06Ej72ENwCDBPhhAnnZ yRRFeBtI5GIGKtIoCdf5vTwKXMV/GsPanJ/keHsrToz4skeUgKQCWAAVPgw3eBc1/L7sej aafcZhf7q5RCB4K0mDsIPHlndGAwLXrNzhBICNkZIT3+ScOcbV2jn149xnAhJLu9EeEuPi v/+W/4hpaU40T+z6+FK+MsfVOO8XRmT85F7vgsEesTBpYV1QMPpQ+Xw7t/7Buw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hZmBl65zCzpGr for ; Wed, 02 Sep 2026 15:01:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25c3c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 02 Sep 2026 15:01:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Baptiste Daroussin Subject: git: 1a669b66ddb4 - main - syslogd: reap pipe children on config reload List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bapt X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1a669b66ddb4748c24116e32dcb51eabaf4859ed Auto-Submitted: auto-generated Date: Wed, 02 Sep 2026 15:01:03 +0000 Message-Id: <6a983a2f.25c3c.14446241@gitrepo.freebsd.org> The branch main has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=1a669b66ddb4748c24116e32dcb51eabaf4859ed commit 1a669b66ddb4748c24116e32dcb51eabaf4859ed Author: Baptiste Daroussin AuthorDate: 2026-09-02 08:51:42 +0000 Commit: Baptiste Daroussin CommitDate: 2026-09-02 15:00:58 +0000 syslogd: reap pipe children on config reload On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its pipe process is still running. close_filed() sets f_type to F_UNUSED before the check, so the condition f_type != F_PIPE is always true and the filed is freed while its process descriptor is still on the dead queue and registered in the kqueue. When the child later exits, the NOTE_EXIT handler dereferences the freed filed (use-after-free) and never closes the process descriptor, leaving the pipe child as a persistent zombie. Capture whether the filed is a pipe with an active process descriptor before calling close_filed(), and defer the free in that case so the NOTE_EXIT handler can reap the child and free the filed. Reviewed by: markj Fixes: 95381c0139d6 (syslogd: Use process descriptors) Differential Revision: https://reviews.freebsd.org/D59319 --- usr.sbin/syslogd/syslogd.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c index e3d144a532b5..f12013c1f316 100644 --- a/usr.sbin/syslogd/syslogd.c +++ b/usr.sbin/syslogd/syslogd.c @@ -2549,6 +2549,7 @@ void closelogfiles(void) { struct filed *f; + bool defer_free; while (!STAILQ_EMPTY(&fhead)) { f = STAILQ_FIRST(&fhead); @@ -2558,6 +2559,13 @@ closelogfiles(void) if (f->f_prevcount) fprintlog_successive(f, 0); + /* + * If a piped process is running, then defer the filed + * cleanup until it exits. close_filed() below sets + * f_type to F_UNUSED, so capture this before calling it. + */ + defer_free = (f->f_type == F_PIPE && f->f_procdesc != -1); + switch (f->f_type) { case F_FILE: case F_FORW: @@ -2585,11 +2593,7 @@ closelogfiles(void) free(f->f_prop_filter); } - /* - * If a piped process is running, then defer the filed - * cleanup until it exits. - */ - if (f->f_type != F_PIPE || f->f_procdesc == -1) + if (!defer_free) free(f); } }