file descriptor leak in 5.2-RC

[David Malone]

> I'd call it a surprise if someone after all had a fix within the next 10
> hours or so.

I'm fairly certain I've found the problem (and, indeed, it looks
like I introduced it too while changing how falloc works). You loose
a reference to /dev/null every time you exec a suid program with
at least one of std{in,out,err} closed. I'm guessing that some part
of postfix does this.

I believe the patch below will fix the problem. I guess I'm too
late for you to test it now?

	David.


Index: kern_descrip.c
===================================================================
RCS file: /cvs/FreeBSD-CVS/src/sys/kern/kern_descrip.c,v
retrieving revision 1.215
diff -u -r1.215 kern_descrip.c
--- kern_descrip.c	19 Oct 2003 20:41:06 -0000	1.215
+++ kern_descrip.c	28 Dec 2003 17:55:00 -0000
@@ -1730,6 +1730,7 @@
 			fp->f_type = DTYPE_VNODE;
 			VOP_UNLOCK(nd.ni_vp, 0, td);
 			devnull = fd;
+			fdrop(fp, td);
 		} else {
 			error = do_dup(td, DUP_FIXED, devnull, i, &retval);
 			if (error != 0)