From patchwork Mon May 6 17:27:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adhemerval Zanella X-Patchwork-Id: 795028 Delivered-To: patch@linaro.org Received: by 2002:adf:a453:0:b0:34e:ceec:bfcd with SMTP id e19csp1036612wra; Mon, 6 May 2024 10:28:36 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCV7DsGsKCn2b7sU6aaHyJJ4wWj4BPDNr/DRG8w8xBeITu+5DKie1WBZxeUDls7RZKAIQ9MMcNG85qKDMZ1kDeOD X-Google-Smtp-Source: AGHT+IF9xCykxkCZpMyCUpDR8Y1LUpg2aAZUubKj3UJBqCA8Pu65Yp59qX10gj6YbGlG4otywEdi X-Received: by 2002:a05:6214:130e:b0:6a0:cb40:128a with SMTP id pn14-20020a056214130e00b006a0cb40128amr14053431qvb.57.1715016515917; Mon, 06 May 2024 10:28:35 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1715016515; cv=pass; d=google.com; s=arc-20160816; b=pfYj24k6hX3Mtohi3pYHMXdfwwYu8IZtZodYqdD6FjnuUZH8evAcF1f3yoelUgxwWH +FvpqQJX68XNGESj7lmdxZVvziEOOcy8RnFYkv3C9retdKW6noDczaIeM18h6dhoNi9z fD0Ajru2epKnoGGdUGue0J/DgzUfNV39TbbkiWJA7dR5ydvkO5A44eaH0DETWKMeoC49 GyzGR5AcikVJp4p8swXyP9an55mIJ/X08QZn4cuEmRrndblV3DwSVcyEWiCt73/6YbPC 5BLZpB5dDH1hZcFDHF59uJkudtwP4f8DptPnf4BamHtox+Jz3XgOwM1mwaM6413BVisf ctmg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature :arc-filter:dmarc-filter:delivered-to; bh=0lC+0aCViI06SJb3eqNLf0i8+xGg5JXchxA8s4bp7a0=; fh=XRtpeyGeZ4wfnaKXv/WSa55z+Edg9xHnbRpDFwWXh3o=; b=EzaxZ/nZ7oX7rsekWgoQLjwlvNOkTODmh8MF6l+brqiKt2qI6EL8fzboM+98XQ6VN5 kU8d21ta2OqwQkvu9J1MFFntYb2TuDhqrk2NW5bINmJGBogF48/gT2z6lEWi4Hr3m/ey 7cnbnIj74VeW16z3x2ZYZbXRl6peTotKyY2eVSAPkKK2JKXu7sIf28qRCGn9fuduyfU+ YYSVy2WV9BGMalgSX6ebeJ2AUyd3t/Ro/J5UOfy6b+VKdKdytXZ9OgznOHYCYeSlRMQW BN4TKsD5NgsQ5oAPKVM2rIgiu93h7y6ee6VyOa7Udo5+9oHb6YTE2GH+MQ927r2m5GPz 7ukQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=riTnduaZ; arc=pass (i=1); spf=pass (google.com: domain of libc-alpha-bounces+patch=linaro.org@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="libc-alpha-bounces+patch=linaro.org@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id j8-20020a05621419c800b0069676318c3asi9877654qvc.62.2024.05.06.10.28.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 May 2024 10:28:35 -0700 (PDT) Received-SPF: pass (google.com: domain of libc-alpha-bounces+patch=linaro.org@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=riTnduaZ; arc=pass (i=1); spf=pass (google.com: domain of libc-alpha-bounces+patch=linaro.org@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="libc-alpha-bounces+patch=linaro.org@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 7FD55385840B for ; Mon, 6 May 2024 17:28:35 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pl1-x62a.google.com (mail-pl1-x62a.google.com [IPv6:2607:f8b0:4864:20::62a]) by sourceware.org (Postfix) with ESMTPS id 312063858D1E for ; Mon, 6 May 2024 17:28:23 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 312063858D1E Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 312063858D1E Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::62a ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1715016505; cv=none; b=bz3ttVnaa+uo0CLcx8oKLCIDe5uDKrPrK0S3OoUkrKDn8rcpIhuovcF4dBXCA3SdZS9TrWfvBpmEq3lgeaO1LODMZobPbku8xbegM5xAF0PP3YnmPYve0vqsmeSRWdcgyf9Qnk5z3fHRF1/pgM2FKZdh++drvx4yPUCKsKXAvlQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1715016505; c=relaxed/simple; bh=K2KLXgjrZjauq7TZyNP61Wy3UQL5DSHFJYa7OwOg5f8=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=ocGDyS9k5QfdnnmV5Es5yfp0daQiT1ATPSKIHGav2Vf2oCFXmZC/fY8N3gr+BXCW0qiA2JMcOBgPbXUMisxiua26h52Dt7Isozct4r8DgGgrc1pFDcmzYTYK+Gux8Jnbw4VudC9Q68jfEWzOu9GK/9Hoy894uiK03U3FUDS7w0k= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pl1-x62a.google.com with SMTP id d9443c01a7336-1ec4dd8525cso16328585ad.3 for ; Mon, 06 May 2024 10:28:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1715016500; x=1715621300; darn=sourceware.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=0lC+0aCViI06SJb3eqNLf0i8+xGg5JXchxA8s4bp7a0=; b=riTnduaZYA1ePU3JNuugQDVdHS5aq3Bv+R69UJ+ygmuYy4nZT/AOQpm6PPp4hDlHjD Ph2PF6ZgzsPgcnAKBPKj4FsGXzqwnEuyGLKMn+Y+R/cTG/+IELp6YmJlgvptPd4SEPS5 3p6ZV7kZ+o7MYqayZlkcyOHDVHN88cJLcPm34ISzSdmBC7ItLUg369/sHs00nuwF5f9S kRMvUnnWkzFvZPuZEQATu+d1w5oFEXS0XnGLZIe43Kk88gHrscfQ+47r04zOmgLgkk8t yn2vCDxeXF2OimB+aOPoDJS+eqVkMm6JVxESXkHsyTZkUlhmtHnaGxmks62nd64l/4bT MPnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715016500; x=1715621300; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0lC+0aCViI06SJb3eqNLf0i8+xGg5JXchxA8s4bp7a0=; b=aNvqJB5z3X9yaaJvRYNbzCpcCka3UfRhnTQ98nb46EjKm3VVgxM/cklF1X80V++nd7 aWgWvMRtYV/VEf6yGzBs4LHt2LMAQ5py9/1Vai4RWAC/tR6hzVu0qtTp6NZ0jLGnkOCX Oy1Tmvs7cdJ6OieHyzu8ktP2szkEbJLynE7N/gRIDGbASgoXW2d/5q0zmcywfsYLifbu hK7LMoXyi9vKbcmJw7vwPxyXwmB8PNS03maM5PTtnKlRUxFYjgB7j+GIwFjCfBWJ4uWo U1FUTUQBPfMpyP0aTCf3qjIeFBfllZe0muw77tpBpsUGQNwEBQV11dO5e/KLkAZ0iUEL IQSw== X-Gm-Message-State: AOJu0YyzF9ytpejULtNn+gcnf3muEU5oYcCo+QB3We7QDlJCT40LwCaj ceRjLoVIGSGy9pzh4ALiYKRuNG6pm6E0HuB4Y5xUu0oah8/o6YGo01i0NyayhBBGzkz9HCEnpio S X-Received: by 2002:a17:90a:dd98:b0:2b2:b02d:3ffd with SMTP id l24-20020a17090add9800b002b2b02d3ffdmr9015616pjv.15.1715016500201; Mon, 06 May 2024 10:28:20 -0700 (PDT) Received: from mandiga.. ([2804:1b3:a7c2:6e56:fc45:bb45:8b35:9b81]) by smtp.gmail.com with ESMTPSA id f11-20020a17090aec8b00b002b436a81fe8sm6745461pjy.39.2024.05.06.10.28.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 May 2024 10:28:19 -0700 (PDT) From: Adhemerval Zanella To: libc-alpha@sourceware.org Cc: Peter Cawley Subject: [PATCH v2] posix: Fix pidfd_spawn/pidfd_spawnp leak if execve fails (BZ 31695) Date: Mon, 6 May 2024 14:27:49 -0300 Message-ID: <20240506172816.1661462-1-adhemerval.zanella@linaro.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Spam-Status: No, score=-12.5 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+patch=linaro.org@sourceware.org If the pidfd_spawn / pidfd_spawnp helper process succeeds, but evecve fails for some reason (either with an invalid/non-existent, memory allocation, etc.) the resulting pidfd is never closed, nor returned to caller (so it can call close). Since the process creation failed, it should be up to posix_spawn to also, close the file descriptor in this case (similar to what it does to reap the process). Checked on x86_64-linux-gnu. --- Changes from v1: - Use __close_nocancel_nostatus instead of __close. --- posix/tst-spawn2.c | 80 +++++++++++++++++++------------- sysdeps/unix/sysv/linux/spawni.c | 20 +++++--- 2 files changed, 61 insertions(+), 39 deletions(-) diff --git a/posix/tst-spawn2.c b/posix/tst-spawn2.c index bb507204a2..b2bad3f1f7 100644 --- a/posix/tst-spawn2.c +++ b/posix/tst-spawn2.c @@ -26,6 +26,7 @@ #include #include +#include #include int @@ -38,38 +39,53 @@ do_test (void) char * const args[] = { 0 }; PID_T_TYPE pid = -1; - int ret = POSIX_SPAWN (&pid, program, 0, 0, args, environ); - if (ret != ENOENT) - { - errno = ret; - FAIL_EXIT1 ("posix_spawn: %m"); - } - - /* POSIX states the value returned on pid variable in case of an error - is not specified. GLIBC will update the value iff the child - execution is successful. */ - if (pid != -1) - FAIL_EXIT1 ("posix_spawn returned pid != -1 (%i)", (int) pid); - - /* Check if no child is actually created. */ - TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); - TEST_COMPARE (errno, ECHILD); - - /* Same as before, but with posix_spawnp. */ - char *args2[] = { (char*) program, 0 }; - - ret = POSIX_SPAWNP (&pid, args2[0], 0, 0, args2, environ); - if (ret != ENOENT) - { - errno = ret; - FAIL_EXIT1 ("posix_spawnp: %m"); - } - - if (pid != -1) - FAIL_EXIT1 ("posix_spawnp returned pid != -1 (%i)", (int) pid); - - TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); - TEST_COMPARE (errno, ECHILD); + { + struct support_descriptors *descrs = support_descriptors_list (); + + int ret = POSIX_SPAWN (&pid, program, 0, 0, args, environ); + if (ret != ENOENT) + { + errno = ret; + FAIL_EXIT1 ("posix_spawn: %m"); + } + + /* POSIX states the value returned on pid variable in case of an error + is not specified. GLIBC will update the value iff the child + execution is successful. */ + if (pid != -1) + FAIL_EXIT1 ("posix_spawn returned pid != -1 (%i)", (int) pid); + + /* Check if no child is actually created. */ + TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); + TEST_COMPARE (errno, ECHILD); + + /* Also check if there is no leak descriptors. */ + support_descriptors_check (descrs); + support_descriptors_free (descrs); + } :+ + { + /* Same as before, but with posix_spawnp. */ + char *args2[] = { (char*) program, 0 }; + + struct support_descriptors *descrs = support_descriptors_list (); + + int ret = POSIX_SPAWNP (&pid, args2[0], 0, 0, args2, environ); + if (ret != ENOENT) + { + errno = ret; + FAIL_EXIT1 ("posix_spawnp: %m"); + } + + if (pid != -1) + FAIL_EXIT1 ("posix_spawnp returned pid != -1 (%i)", (int) pid); + + TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); + TEST_COMPARE (errno, ECHILD); + + support_descriptors_check (descrs); + support_descriptors_free (descrs); + } return 0; } diff --git a/sysdeps/unix/sysv/linux/spawni.c b/sysdeps/unix/sysv/linux/spawni.c index e8ed2babb9..1556dd17e0 100644 --- a/sysdeps/unix/sysv/linux/spawni.c +++ b/sysdeps/unix/sysv/linux/spawni.c @@ -449,13 +449,19 @@ __spawnix (int *pid, const char *file, caller to actually collect it. */ ec = args.err; if (ec > 0) - /* There still an unlikely case where the child is cancelled after - setting args.err, due to a positive error value. Also there is - possible pid reuse race (where the kernel allocated the same pid - to an unrelated process). Unfortunately due synchronization - issues where the kernel might not have the process collected - the waitpid below can not use WNOHANG. */ - __waitpid (new_pid, NULL, 0); + { + /* There still an unlikely case where the child is cancelled after + setting args.err, due to a positive error value. Also there is + possible pid reuse race (where the kernel allocated the same pid + to an unrelated process). Unfortunately due synchronization + issues where the kernel might not have the process collected + the waitpid below can not use WNOHANG. */ + __waitpid (new_pid, NULL, 0); + /* For pidfd we need to also close the file descriptor for the case + where execve fails. */ + if (use_pidfd) + __close_nocancel_nostatus (args.pidfd); + } } else ec = errno;