From patchwork Mon May 6 16:26:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adhemerval Zanella Netto X-Patchwork-Id: 1932118 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=rzSdYiZ3; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VY6JM2PQGz1xnT for ; Tue, 7 May 2024 02:27:30 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id BA8BE3858C31 for ; Mon, 6 May 2024 16:27:27 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) by sourceware.org (Postfix) with ESMTPS id 2955A3858D33 for ; Mon, 6 May 2024 16:27:04 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 2955A3858D33 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 2955A3858D33 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::435 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1715012826; cv=none; b=mAvZFpF86RXKyxCJRh+NQhaid7AN8bZ2aSutyiZXYum7JPXyxPixGjHd1ci0j0/AkBAbsVY9JZEB3FELsrfmS9hfBQtfE/8UOF2tEqeNTkCOJEWBQoY6v3tudaTeBTw/Xm64lRdwk/P1UcIpb29ZRkJPHMy7Q/jz8WA2VsEk1Ps= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1715012826; c=relaxed/simple; bh=c+loROMWmOCT+Y38CF3geBECDfakfHpoF1ehvCLefEE=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=csEXl3MISfNITIBgorvx0qjVi0kLc7+8/1RWX9P26FB3oympG39iDY4KrhWyjA/IhrV7pmmTg2ckjFR5UXL2RSAj1wVwJnpa8JLRKdk6h3NlH1CeCCRrw59cCTB3yO1/IedbldkAGopJ0vWu+Ai9GMDX8wyE+r/XZ6t7QUjFmfM= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pf1-x435.google.com with SMTP id d2e1a72fcca58-6f4551f2725so2074044b3a.1 for ; Mon, 06 May 2024 09:27:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1715012823; x=1715617623; darn=sourceware.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Taq4oyS6RCjEUc7eVBPxcQp0GZAXQlPuY7XKhgm3R6Y=; b=rzSdYiZ3vObCFZcr2HmfKBEBHRGWZOiUyJh5bXS4AUDZzTVt+KQ0/hEPzxLPEbVzfa idVJ7MMdk5DqLxmaS3SPljjQ59RvIzvXzWvwo1WBJpApTqHUkpaeiv0w26vZ0fbHyZ6p M6C9StWsD/o1lqRsWK6bqUSvKVbW+gWz82i4p7aqV7eMbDMOwE0+rNCf0XBsPMvb1c03 O4aNChNj8Z4vq3pVp/Uc/13KGAV005ZLtSWNn++Q3zDJgTQxhGHyH7VVf+lrP+TChfTb d/3wNr27isfh6BQvKiOiFkAE2G4N3+2FcxoCa/gsm64K9BfSzffEvATkvOYjW2iH7XN3 VHKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715012823; x=1715617623; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Taq4oyS6RCjEUc7eVBPxcQp0GZAXQlPuY7XKhgm3R6Y=; b=EnCW5OhtzISR4l4U29qjTp09plPYXWBGVFc6oG+IqccAdG9N0g9tLuq0q9HqTybbKP h7Gfp5pCbtWgwNGbjUho++iUK4BJiNKf0j76SVCkWelkZ9uiLqAXPjrFy5dwR5Qf6O4c 79WdbDQX+aM4kp5SpgF9g5AJjEEzmyORpuaoDfO2JHfHrA+aDJ2PmbcOoCXCbz6RhGHe +0Ia4NIn+T6ybjAM11UlIthqNBqBVsjCubIFEp6zY9VFt5c+D02/BXGKOzUeSIZzIBK8 GHmo2kC9YISquC6NZ30Hocg3LpqD6Vutx97lZW9bJtoJBkiwAHvYN7d95ZqZdc9gtHgQ fMAA== X-Gm-Message-State: AOJu0Yxy19OtIZ19+XFVAngzy4dQpMgh5ufRcpCd020PtT+BSjUapkT6 T4JRA8ov3b3qCpCmPVRVGUK7BpR/VJvq3YwHueUB5RlYnzf6aXRYLMAIr9cigF46pAV/4o5HKHa XXn4= X-Google-Smtp-Source: AGHT+IH6IbS4DilNJM0JdkgVus72pbP1+WCxKYbkc6eN2aWXM9XT7zWqalz8otX3tVN3pMczzUOuUg== X-Received: by 2002:a05:6a20:9f49:b0:1af:8e8d:cefd with SMTP id ml9-20020a056a209f4900b001af8e8dcefdmr9167618pzb.51.1715012822481; Mon, 06 May 2024 09:27:02 -0700 (PDT) Received: from mandiga.. ([2804:1b3:a7c2:6e56:fc45:bb45:8b35:9b81]) by smtp.gmail.com with ESMTPSA id q8-20020a17090a178800b002b24c3fce2esm9098620pja.33.2024.05.06.09.27.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 May 2024 09:27:01 -0700 (PDT) From: Adhemerval Zanella To: libc-alpha@sourceware.org Cc: Peter Cawley Subject: [PATCH] posix: Fix pidfd_spawn/pidfd_spawnp leak if execve fails (BZ 31695) Date: Mon, 6 May 2024 13:26:56 -0300 Message-ID: <20240506162658.1571389-1-adhemerval.zanella@linaro.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Spam-Status: No, score=-12.5 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org If the pidfd_spawn / pidfd_spawnp helper process succeeds, but evecve fails for some reason (either with an invalid/non-existent, memory allocation, etc.) the resulting pidfd is never closed, nor returned to caller (so it can call close). Since the process creation failed, it should be up to posix_spawn to also, close the file descriptor in this case (similar to what it does to reap the process). Checked on x86_64-linux-gnu. --- posix/tst-spawn2.c | 80 +++++++++++++++++++------------- sysdeps/unix/sysv/linux/spawni.c | 20 +++++--- 2 files changed, 61 insertions(+), 39 deletions(-) diff --git a/posix/tst-spawn2.c b/posix/tst-spawn2.c index bb507204a2..b2bad3f1f7 100644 --- a/posix/tst-spawn2.c +++ b/posix/tst-spawn2.c @@ -26,6 +26,7 @@ #include #include +#include #include int @@ -38,38 +39,53 @@ do_test (void) char * const args[] = { 0 }; PID_T_TYPE pid = -1; - int ret = POSIX_SPAWN (&pid, program, 0, 0, args, environ); - if (ret != ENOENT) - { - errno = ret; - FAIL_EXIT1 ("posix_spawn: %m"); - } - - /* POSIX states the value returned on pid variable in case of an error - is not specified. GLIBC will update the value iff the child - execution is successful. */ - if (pid != -1) - FAIL_EXIT1 ("posix_spawn returned pid != -1 (%i)", (int) pid); - - /* Check if no child is actually created. */ - TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); - TEST_COMPARE (errno, ECHILD); - - /* Same as before, but with posix_spawnp. */ - char *args2[] = { (char*) program, 0 }; - - ret = POSIX_SPAWNP (&pid, args2[0], 0, 0, args2, environ); - if (ret != ENOENT) - { - errno = ret; - FAIL_EXIT1 ("posix_spawnp: %m"); - } - - if (pid != -1) - FAIL_EXIT1 ("posix_spawnp returned pid != -1 (%i)", (int) pid); - - TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); - TEST_COMPARE (errno, ECHILD); + { + struct support_descriptors *descrs = support_descriptors_list (); + + int ret = POSIX_SPAWN (&pid, program, 0, 0, args, environ); + if (ret != ENOENT) + { + errno = ret; + FAIL_EXIT1 ("posix_spawn: %m"); + } + + /* POSIX states the value returned on pid variable in case of an error + is not specified. GLIBC will update the value iff the child + execution is successful. */ + if (pid != -1) + FAIL_EXIT1 ("posix_spawn returned pid != -1 (%i)", (int) pid); + + /* Check if no child is actually created. */ + TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); + TEST_COMPARE (errno, ECHILD); + + /* Also check if there is no leak descriptors. */ + support_descriptors_check (descrs); + support_descriptors_free (descrs); + } + + { + /* Same as before, but with posix_spawnp. */ + char *args2[] = { (char*) program, 0 }; + + struct support_descriptors *descrs = support_descriptors_list (); + + int ret = POSIX_SPAWNP (&pid, args2[0], 0, 0, args2, environ); + if (ret != ENOENT) + { + errno = ret; + FAIL_EXIT1 ("posix_spawnp: %m"); + } + + if (pid != -1) + FAIL_EXIT1 ("posix_spawnp returned pid != -1 (%i)", (int) pid); + + TEST_COMPARE (WAITID (P_ALL, 0, NULL, WEXITED), -1); + TEST_COMPARE (errno, ECHILD); + + support_descriptors_check (descrs); + support_descriptors_free (descrs); + } return 0; } diff --git a/sysdeps/unix/sysv/linux/spawni.c b/sysdeps/unix/sysv/linux/spawni.c index e8ed2babb9..ca540f11a2 100644 --- a/sysdeps/unix/sysv/linux/spawni.c +++ b/sysdeps/unix/sysv/linux/spawni.c @@ -449,13 +449,19 @@ __spawnix (int *pid, const char *file, caller to actually collect it. */ ec = args.err; if (ec > 0) - /* There still an unlikely case where the child is cancelled after - setting args.err, due to a positive error value. Also there is - possible pid reuse race (where the kernel allocated the same pid - to an unrelated process). Unfortunately due synchronization - issues where the kernel might not have the process collected - the waitpid below can not use WNOHANG. */ - __waitpid (new_pid, NULL, 0); + { + /* There still an unlikely case where the child is cancelled after + setting args.err, due to a positive error value. Also there is + possible pid reuse race (where the kernel allocated the same pid + to an unrelated process). Unfortunately due synchronization + issues where the kernel might not have the process collected + the waitpid below can not use WNOHANG. */ + __waitpid (new_pid, NULL, 0); + /* For pidfd we need to also close the file descriptor for the case + where execve fails. */ + if (use_pidfd) + __close (args.pidfd); + } } else ec = errno;