mirror of
https://github.com/RGBCube/serenity
synced 2025-07-26 07:37:35 +00:00
Kernel: Make Process::file_description() vend a RefPtr<FileDescription>
This encourages callers to strongly reference file descriptions while working with them. This fixes a use-after-free issue where one thread would close() an open fd while another thread was blocked on it becoming readable. Test: Kernel/uaf-close-while-blocked-in-read.cpp
This commit is contained in:
parent
a47f3031ae
commit
5387a19268
4 changed files with 66 additions and 46 deletions
30
Tests/Kernel/uaf-close-while-blocked-in-read.cpp
Normal file
30
Tests/Kernel/uaf-close-while-blocked-in-read.cpp
Normal file
|
@ -0,0 +1,30 @@
|
|||
#include <pthread.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
|
||||
int pipefds[2];
|
||||
|
||||
int main(int, char**)
|
||||
{
|
||||
pipe(pipefds);
|
||||
|
||||
pthread_t tid;
|
||||
pthread_create(
|
||||
&tid, nullptr, [](void*) -> void* {
|
||||
sleep(1);
|
||||
printf("Second thread closing pipes!\n");
|
||||
close(pipefds[0]);
|
||||
close(pipefds[1]);
|
||||
pthread_exit(nullptr);
|
||||
return nullptr;
|
||||
},
|
||||
nullptr);
|
||||
|
||||
printf("First thread doing a blocking read from pipe...\n");
|
||||
char buffer[16];
|
||||
int nread = read(pipefds[0], buffer, sizeof(buffer));
|
||||
printf("Ok, read %d bytes from pipe\n", nread);
|
||||
|
||||
return 0;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue