[Bug libc/12847] dprintf/vdprintf can cause fork to fail (child process crash)

[f.deldegan at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=12847

Francesco 'pr0gg3d' Del Degan <f.deldegan at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |f.deldegan at gmail dot com

--- Comment #5 from Francesco 'pr0gg3d' Del Degan <f.deldegan at gmail dot com> ---
Hi, I maybe can add another testcase, using syslog.

In one of our program, it happens that a call to syslog() is made and no
/dev/log listener (syslog daemon) is listening.

If i got it correctly, a fallback method in libc/misc/syslog.c is to open
/dev/console:

   298            if (LogStat & LOG_CONS &&
   299                (fd = __open(_PATH_CONSOLE, O_WRONLY|O_NOCTTY, 0)) >= 0)
   300              {
   301                dprintf (fd, "%s\r\n", buf + msgoff);
   302                (void)__close(fd);
   303              }
   304              }

that leads to add a _IO_file into _IO_list_all with a NULL lock, because of
dprintf.

If in meantime, before fd is closed, a fork occurs and the child crashes with a
SEGV at:

static void
fresetlockfiles (void)
{
  _IO_ITER i;

  for (i = _IO_iter_begin(); i != _IO_iter_end(); i = _IO_iter_next(i))
    _IO_lock_init (*((_IO_lock_t *) _IO_iter_file(i)->_lock));
}


because _lock is NULL.

I not have a fix yet to propose, because i just started to dig into libc code,
but i'm wondering if it's correct to call a dprintf there since is not
fork-safe.

Notice that syslog is the *only* libc-internal caller of dprintf.

Thank you,
  Francesco

-- 
You are receiving this mail because:
You are on the CC list for the bug.