| Commit message (Expand) | Author | Age | Files | Lines |
|---|
| * | system is a cancellation point•••ideally, system would also be cancellable while running the external
command, but I cannot find any way to make that work without either
leaking zombie processes or introducing behavior that is far outside
what the standard specifies. glibc handles cancellation by killing the
child process with SIGKILL, but this could be unsafe in that it could
leave the data being manipulated by the command in an inconsistent
state.
| Rich Felker | 2012-10-28 | 1 | -0/+3 |
| * | fix usage of locks with vfork•••__release_ptc() is only valid in the parent; if it's performed in the
child, the lock will be unlocked early then double-unlocked later,
corrupting the lock state.
| Rich Felker | 2012-10-19 | 2 | -2/+3 |
| * | fix parent-memory-clobber in posix_spawn (environ) | Rich Felker | 2012-10-18 | 3 | -9/+17 |
| * | overhaul system() and popen() to use vfork; fix various related bugs•••since we target systems without overcommit, special care should be
taken that system() and popen(), like posix_spawn(), do not fail in
processes whose commit charges are too high to allow ordinary forking.
this in turn requires special precautions to ensure that the parent
process's signal handlers do not end up running in the shared-memory
child, where they could corrupt the state of the parent process.
popen has also been updated to use pipe2, so it does not have a
fd-leak race in multi-threaded programs. since pipe2 is missing on
older kernels, (non-atomic) emulation has been added.
some silly bugs in the old code should be gone too.
| Rich Felker | 2012-10-18 | 2 | -29/+49 |
| * | block uid/gid changes during posix_spawn•••usage of vfork creates a situation where a process of lower privilege
may momentarily have write access to the memory of a process of higher
privilege.
consider the case of a multi-threaded suid program which is calling
posix_spawn in one thread while another thread drops the elevated
privileges then runs untrusted (relative to the elevated privilege)
code as the original invoking user. this untrusted code can then
potentially modify the data the child process will use before calling
exec, for example changing the pathname or arguments that will be
passed to exec.
note that if vfork is implemented as fork, the lock will not be held
until the child execs, but since memory is not shared it does not
matter.
| Rich Felker | 2012-10-15 | 1 | -0/+10 |
| * | use vfork if possible in posix_spawn•••vfork is implemented as the fork syscall (with no atfork handlers run)
on archs where it is not available, so this change does not introduce
any change in behavior or regression for such archs.
| Rich Felker | 2012-09-14 | 1 | -1/+3 |
| * | use restrict everywhere it's required by c99 and/or posix 2008•••to deal with the fact that the public headers may be used with pre-c99
compilers, __restrict is used in place of restrict, and defined
appropriately for any supported compiler. we also avoid the form
[restrict] since older versions of gcc rejected it due to a bug in the
original c99 standard, and instead use the form *restrict.
| Rich Felker | 2012-09-06 | 9 | -18/+18 |
| * | x86_64 vfork implementation•••untested; should work.
| Rich Felker | 2012-02-06 | 1 | -0/+12 |
| * | support vfork on i386 | Rich Felker | 2011-10-14 | 1 | -0/+14 |
| * | make available a namespace-safe vfork, if supported•••this may be useful to posix_spawn..?
| Rich Felker | 2011-10-14 | 1 | -1/+4 |
| * | fix various bugs in path and error handling in execvp/fexecve | Rich Felker | 2011-09-29 | 2 | -18/+29 |
| * | fix various errors in function signatures/prototypes found by nsz | Rich Felker | 2011-09-13 | 2 | -5/+8 |
| * | add missing posix_spawnattr_init/destroy functions | Rich Felker | 2011-09-13 | 2 | -0/+13 |
| * | use weak aliases rather than function pointers to simplify some code | Rich Felker | 2011-08-06 | 1 | -2/+8 |
| * | ensure in fork that child gets its own new robust mutex list | Rich Felker | 2011-07-16 | 1 | -0/+1 |
| * | fix backwards posix_spawn file action order | Rich Felker | 2011-05-29 | 5 | -6/+10 |
| * | add accidentally-omitted file needed for posix_spawn file actions | Rich Felker | 2011-05-28 | 1 | -0/+10 |
| * | add file actions support to posix_spawn | Rich Felker | 2011-05-28 | 5 | -2/+85 |
| * | posix_spawn: honor POSIX_SPAWN_SETSIGDEF flag | Rich Felker | 2011-05-28 | 1 | -1/+3 |
| * | initial implementation of posix_spawn•••file actions are not yet implemented, but everything else should be
mostly complete and roughly correct.
| Rich Felker | 2011-05-28 | 12 | -0/+151 |
| * | correct variadic prototypes for execl* family•••the old versions worked, but conflicted with programs which declared
their own prototypes and generated warnings with some versions of gcc.
| Rich Felker | 2011-04-27 | 3 | -15/+18 |
| * | fix minor bugs due to incorrect threaded-predicate semantics•••some functions that should have been testing whether pthread_self()
had been called and initialized the thread pointer were instead
testing whether pthread_create() had been called and actually made the
program "threaded". while it's unlikely any mismatch would occur in
real-world problems, this could have introduced subtle bugs. now, we
store the address of the main thread's thread descriptor in the libc
structure and use its presence as a flag that the thread register is
initialized. note that after fork, the calling thread (not necessarily
the original main thread) is the new main thread.
| Rich Felker | 2011-04-20 | 1 | -1/+2 |
| * | clean up handling of thread/nothread mode, locking | Rich Felker | 2011-04-17 | 1 | -1/+1 |
| * | overhaul pthread cancellation•••this patch improves the correctness, simplicity, and size of
cancellation-related code. modulo any small errors, it should now be
completely conformant, safe, and resource-leak free.
the notion of entering and exiting cancellation-point context has been
completely eliminated and replaced with alternative syscall assembly
code for cancellable syscalls. the assembly is responsible for setting
up execution context information (stack pointer and address of the
syscall instruction) which the cancellation signal handler can use to
determine whether the interrupted code was in a cancellable state.
these changes eliminate race conditions in the previous generation of
cancellation handling code (whereby a cancellation request received
just prior to the syscall would not be processed, leaving the syscall
to block, potentially indefinitely), and remedy an issue where
non-cancellable syscalls made from signal handlers became cancellable
if the signal handler interrupted a cancellation point.
x86_64 asm is untested and may need a second try to get it right.
| Rich Felker | 2011-04-17 | 2 | -12/+2 |
| * | speed up threaded fork•••after fork, we have a new process and the pid is equal to the tid of
the new main thread. there is no need to make two separate syscalls to
obtain the same number.
| Rich Felker | 2011-04-12 | 1 | -2/+1 |
| * | overhaul cancellation to fix resource leaks and dangerous behavior with signals•••this commit addresses two issues:
1. a race condition, whereby a cancellation request occurring after a
syscall returned from kernelspace but before the subsequent
CANCELPT_END would cause cancellable resource-allocating syscalls
(like open) to leak resources.
2. signal handlers invoked while the thread was blocked at a
cancellation point behaved as if asynchronous cancellation mode wer in
effect, resulting in potentially dangerous state corruption if a
cancellation request occurs.
the glibc/nptl implementation of threads shares both of these issues.
with this commit, both are fixed. however, cancellation points
encountered in a signal handler will not be acted upon if the signal
was received while the thread was already at a cancellation point.
they will of course be acted upon after the signal handler returns, so
in real-world usage where signal handlers quickly return, it should
not be a problem. it's possible to solve this problem too by having
sigaction() wrap all signal handlers with a function that uses a
pthread_cleanup handler to catch cancellation, patch up the saved
context, and return into the cancellable function that will catch and
act upon the cancellation. however that would be a lot of complexity
for minimal if any benefit...
| Rich Felker | 2011-03-24 | 2 | -2/+14 |
| * | global cleanup to use the new syscall interface | Rich Felker | 2011-03-20 | 5 | -7/+7 |
| * | make fork properly initialize the main thread in the child process | Rich Felker | 2011-03-09 | 1 | -0/+7 |
| * | implement fexecve | Rich Felker | 2011-02-27 | 1 | -0/+10 |
| * | add pthread_atfork interface•••note that this presently does not handle consistency of the libc's own
global state during forking. as per POSIX 2008, if the parent process
was threaded, the child process may only call async-signal-safe
functions until one of the exec-family functions is called, so the
current behavior is believed to be conformant even if non-ideal. it
may be improved at some later time.
| Rich Felker | 2011-02-18 | 1 | -3/+6 |
| * | initial check-in, version 0.5.0 | Rich Felker | 2011-02-12 | 12 | -0/+194 |
