Module Name:    src
Committed By:   kamil
Date:           Mon Apr 16 14:52:00 UTC 2018

Modified Files:
        src/share/man/man9: fork1.9
        src/sys/compat/freebsd: freebsd_fork.c
        src/sys/compat/linux/common: linux_sched.c
        src/sys/kern: init_main.c kern_fork.c
        src/sys/sys: proc.h

Log Message:
Remove the rnewprocp argument from fork1(9)

It's now unused and it can cause use-after-free scenarios as noted by
<Mateusz Guzik>.

Reference: http://mail-index.netbsd.org/tech-kern/2017/09/08/msg022267.html

Sponsored by <The NetBSD Foundation>


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 src/share/man/man9/fork1.9
cvs rdiff -u -r1.8 -r1.9 src/sys/compat/freebsd/freebsd_fork.c
cvs rdiff -u -r1.70 -r1.71 src/sys/compat/linux/common/linux_sched.c
cvs rdiff -u -r1.496 -r1.497 src/sys/kern/init_main.c
cvs rdiff -u -r1.203 -r1.204 src/sys/kern/kern_fork.c
cvs rdiff -u -r1.344 -r1.345 src/sys/sys/proc.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/share/man/man9/fork1.9
diff -u src/share/man/man9/fork1.9:1.14 src/share/man/man9/fork1.9:1.15
--- src/share/man/man9/fork1.9:1.14	Wed Apr 30 13:10:58 2008
+++ src/share/man/man9/fork1.9	Mon Apr 16 14:51:59 2018
@@ -1,4 +1,4 @@
-.\"	$NetBSD: fork1.9,v 1.14 2008/04/30 13:10:58 martin Exp $
+.\"	$NetBSD: fork1.9,v 1.15 2018/04/16 14:51:59 kamil Exp $
 .\"
 .\" Copyright (c) 1998 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -28,7 +28,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd January 4, 2008
+.Dd April 16, 2018
 .Dt FORK1 9
 .Os
 .Sh NAME
@@ -38,7 +38,7 @@
 .In sys/types.h
 .In sys/proc.h
 .Ft int
-.Fn "fork1" "struct lwp *l1" "int flags" "int exitsig" "void *stack" "size_t stacksize" "void (*func)(void *)" "void *arg" "register_t *retval" "struct proc **rnewprocp"
+.Fn "fork1" "struct lwp *l1" "int flags" "int exitsig" "void *stack" "size_t stacksize" "void (*func)(void *)" "void *arg" "register_t *retval"
 .Sh DESCRIPTION
 .Fn fork1
 creates a new process out of the process behind
@@ -132,13 +132,6 @@ User level system call stubs typically s
 and bitwise-AND it with
 .Ar retval[0] ,
 thus returning the pid to the parent process and 0 to the child.
-.Pp
-If
-.Ar rnewprocp
-is not NULL,
-.Ar *rnewprocp
-will point to the newly created process upon successful completion of
-the fork operation.
 .Sh RETURN VALUES
 Upon successful completion of the fork operation,
 .Fn fork1

Index: src/sys/compat/freebsd/freebsd_fork.c
diff -u src/sys/compat/freebsd/freebsd_fork.c:1.8 src/sys/compat/freebsd/freebsd_fork.c:1.9
--- src/sys/compat/freebsd/freebsd_fork.c:1.8	Tue Aug  8 08:04:06 2017
+++ src/sys/compat/freebsd/freebsd_fork.c	Mon Apr 16 14:51:59 2018
@@ -1,4 +1,4 @@
-/*	$NetBSD: freebsd_fork.c,v 1.8 2017/08/08 08:04:06 maxv Exp $	*/
+/*	$NetBSD: freebsd_fork.c,v 1.9 2018/04/16 14:51:59 kamil Exp $	*/
 
 /*-
  * Copyright (c) 2002 The NetBSD Foundation, Inc.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: freebsd_fork.c,v 1.8 2017/08/08 08:04:06 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: freebsd_fork.c,v 1.9 2018/04/16 14:51:59 kamil Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -81,5 +81,5 @@ freebsd_sys_rfork(struct lwp *l, const s
 
 	return (fork1(l, flags,
 	    SCARG(uap, flags) & FREEBSD_RFLINUXTHPN ? SIGUSR1 : SIGCHLD,
-	    NULL, 0, NULL, NULL, retval, NULL));
+	    NULL, 0, NULL, NULL, retval));
 }

Index: src/sys/compat/linux/common/linux_sched.c
diff -u src/sys/compat/linux/common/linux_sched.c:1.70 src/sys/compat/linux/common/linux_sched.c:1.71
--- src/sys/compat/linux/common/linux_sched.c:1.70	Sun Apr 15 03:25:25 2018
+++ src/sys/compat/linux/common/linux_sched.c	Mon Apr 16 14:51:59 2018
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_sched.c,v 1.70 2018/04/15 03:25:25 kamil Exp $	*/
+/*	$NetBSD: linux_sched.c,v 1.71 2018/04/16 14:51:59 kamil Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux_sched.c,v 1.70 2018/04/15 03:25:25 kamil Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_sched.c,v 1.71 2018/04/16 14:51:59 kamil Exp $");
 
 #include <sys/param.h>
 #include <sys/mount.h>
@@ -158,7 +158,7 @@ linux_sys_clone(struct lwp *l, const str
 	 * that makes this adjustment is a noop.
 	 */
 	if ((error = fork1(l, flags, sig, SCARG(uap, stack), 0,
-	    linux_child_return, NULL, retval, NULL)) != 0) {
+	    linux_child_return, NULL, retval)) != 0) {
 		DPRINTF(("%s: fork1: error %d\n", __func__, error));
 		return error;
 	}

Index: src/sys/kern/init_main.c
diff -u src/sys/kern/init_main.c:1.496 src/sys/kern/init_main.c:1.497
--- src/sys/kern/init_main.c:1.496	Mon Apr 16 14:18:16 2018
+++ src/sys/kern/init_main.c	Mon Apr 16 14:51:59 2018
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_main.c,v 1.496 2018/04/16 14:18:16 kamil Exp $	*/
+/*	$NetBSD: init_main.c,v 1.497 2018/04/16 14:51:59 kamil Exp $	*/
 
 /*-
  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -97,7 +97,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: init_main.c,v 1.496 2018/04/16 14:18:16 kamil Exp $");
+__KERNEL_RCSID(0, "$NetBSD: init_main.c,v 1.497 2018/04/16 14:51:59 kamil Exp $");
 
 #include "opt_ddb.h"
 #include "opt_inet.h"
@@ -608,7 +608,7 @@ main(void)
 	 * wait for us to inform it that the root file system has been
 	 * mounted.
 	 */
-	if (fork1(l, 0, SIGCHLD, NULL, 0, start_init, NULL, NULL, NULL))
+	if (fork1(l, 0, SIGCHLD, NULL, 0, start_init, NULL, NULL))
 		panic("fork init");
 
 	/*

Index: src/sys/kern/kern_fork.c
diff -u src/sys/kern/kern_fork.c:1.203 src/sys/kern/kern_fork.c:1.204
--- src/sys/kern/kern_fork.c:1.203	Tue Nov  7 19:44:04 2017
+++ src/sys/kern/kern_fork.c	Mon Apr 16 14:51:59 2018
@@ -1,4 +1,4 @@
-/*	$NetBSD: kern_fork.c,v 1.203 2017/11/07 19:44:04 christos Exp $	*/
+/*	$NetBSD: kern_fork.c,v 1.204 2018/04/16 14:51:59 kamil Exp $	*/
 
 /*-
  * Copyright (c) 1999, 2001, 2004, 2006, 2007, 2008 The NetBSD Foundation, Inc.
@@ -67,7 +67,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_fork.c,v 1.203 2017/11/07 19:44:04 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_fork.c,v 1.204 2018/04/16 14:51:59 kamil Exp $");
 
 #include "opt_ktrace.h"
 #include "opt_dtrace.h"
@@ -117,7 +117,7 @@ int
 sys_fork(struct lwp *l, const void *v, register_t *retval)
 {
 
-	return fork1(l, 0, SIGCHLD, NULL, 0, NULL, NULL, retval, NULL);
+	return fork1(l, 0, SIGCHLD, NULL, 0, NULL, NULL, retval);
 }
 
 /*
@@ -129,7 +129,7 @@ sys_vfork(struct lwp *l, const void *v, 
 {
 
 	return fork1(l, FORK_PPWAIT, SIGCHLD, NULL, 0, NULL, NULL,
-	    retval, NULL);
+	    retval);
 }
 
 /*
@@ -141,7 +141,7 @@ sys___vfork14(struct lwp *l, const void 
 {
 
 	return fork1(l, FORK_PPWAIT|FORK_SHAREVM, SIGCHLD, NULL, 0,
-	    NULL, NULL, retval, NULL);
+	    NULL, NULL, retval);
 }
 
 /*
@@ -194,7 +194,7 @@ sys___clone(struct lwp *l, const struct 
 	 * code that makes this adjustment is a noop.
 	 */
 	return fork1(l, flags, sig, SCARG(uap, stack), 0,
-	    NULL, NULL, retval, NULL);
+	    NULL, NULL, retval);
 }
 
 /*
@@ -209,8 +209,7 @@ static struct timeval fork_tfmrate = { 1
  */
 int
 fork1(struct lwp *l1, int flags, int exitsig, void *stack, size_t stacksize,
-    void (*func)(void *), void *arg, register_t *retval,
-    struct proc **rnewprocp)
+    void (*func)(void *), void *arg, register_t *retval)
 {
 	struct proc	*p1, *p2, *parent;
 	struct plimit   *p1_lim;
@@ -524,12 +523,6 @@ fork1(struct lwp *l1, int flags, int exi
 	if (flags & FORK_SHAREVM)
 		uvmexp.forks_sharevm++;
 
-	/*
-	 * Pass a pointer to the new process to the caller.
-	 */
-	if (rnewprocp != NULL)
-		*rnewprocp = p2;
-
 	if (ktrpoint(KTR_EMUL))
 		p2->p_traceflag |= KTRFAC_TRC_EMUL;
 

Index: src/sys/sys/proc.h
diff -u src/sys/sys/proc.h:1.344 src/sys/sys/proc.h:1.345
--- src/sys/sys/proc.h:1.344	Tue Jan  9 20:55:43 2018
+++ src/sys/sys/proc.h	Mon Apr 16 14:51:59 2018
@@ -1,4 +1,4 @@
-/*	$NetBSD: proc.h,v 1.344 2018/01/09 20:55:43 maya Exp $	*/
+/*	$NetBSD: proc.h,v 1.345 2018/04/16 14:51:59 kamil Exp $	*/
 
 /*-
  * Copyright (c) 2006, 2007, 2008 The NetBSD Foundation, Inc.
@@ -522,7 +522,7 @@ void	proc_free_pid(pid_t);
 void	proc_free_mem(struct proc *);
 void	exit_lwps(struct lwp *l);
 int	fork1(struct lwp *, int, int, void *, size_t,
-	    void (*)(void *), void *, register_t *, struct proc **);
+	    void (*)(void *), void *, register_t *);
 int	pgid_in_session(struct proc *, pid_t);
 void	cpu_lwp_fork(struct lwp *, struct lwp *, void *, size_t,
 	    void (*)(void *), void *);

Reply via email to