Blame SOURCES/0025-daemon-Fix-double-closed-fd-race-condition.patch

8f9a28
From b2ec373cfec2dd6a39acfd91ea1a67618ee209ac Mon Sep 17 00:00:00 2001
8f9a28
From: Martin Kutlak <mkutlak@redhat.com>
8f9a28
Date: Tue, 20 Nov 2018 19:03:55 +0100
8f9a28
Subject: [PATCH] daemon: Fix double closed fd race condition
8f9a28
8f9a28
When a communication channel is set up between abrtd and abrt-server it uses
8f9a28
abrt_gio_channel_unix_new(). In that function there is a call g_io_channel_set_close_on_unref() [1].
8f9a28
This function sets whether to close a file/socket/whatever associated with the channel when channel
8f9a28
recieves a final unref and is to be destroyed.
8f9a28
8f9a28
Calling a close() on fd associated with the channel before/after g_io_channel_unref()
8f9a28
created a double close() race condition when ABRT was processing a lot of crashes at the same time.
8f9a28
8f9a28
Thank you benzea for the patch.
8f9a28
8f9a28
Related BZ#1650622
8f9a28
8f9a28
1 - https://developer.gnome.org/glib/stable/glib-IO-Channels.html#g-io-channel-get-close-on-unref
8f9a28
8f9a28
Signed-off-by: Martin Kutlak <mkutlak@redhat.com>
8f9a28
---
8f9a28
 src/daemon/abrt-server.c | 1 -
8f9a28
 src/daemon/abrtd.c       | 4 +---
8f9a28
 2 files changed, 1 insertion(+), 4 deletions(-)
8f9a28
8f9a28
diff --git a/src/daemon/abrt-server.c b/src/daemon/abrt-server.c
8f9a28
index 692ccee38..90068069d 100644
8f9a28
--- a/src/daemon/abrt-server.c
8f9a28
+++ b/src/daemon/abrt-server.c
8f9a28
@@ -364,7 +364,6 @@ static int run_post_create(const char *dirname, struct response *resp)
8f9a28
     g_main_loop_unref(context.main_loop);
8f9a28
     g_io_channel_unref(channel_signal);
8f9a28
     close(g_signal_pipe[1]);
8f9a28
-    close(g_signal_pipe[0]);
8f9a28
 
8f9a28
     log_notice("Waiting finished");
8f9a28
 
8f9a28
diff --git a/src/daemon/abrtd.c b/src/daemon/abrtd.c
8f9a28
index 32753966b..fefb2e9c9 100644
8f9a28
--- a/src/daemon/abrtd.c
8f9a28
+++ b/src/daemon/abrtd.c
8f9a28
@@ -114,7 +114,6 @@ static void stop_abrt_server(struct abrt_server_proc *proc)
8f9a28
 
8f9a28
 static void dispose_abrt_server(struct abrt_server_proc *proc)
8f9a28
 {
8f9a28
-    close(proc->fdout);
8f9a28
     free(proc->dirname);
8f9a28
 
8f9a28
     if (proc->watch_id > 0)
8f9a28
@@ -231,8 +230,7 @@ static gboolean abrt_server_output_cb(GIOChannel *channel, GIOCondition conditio
8f9a28
     GList *item = g_list_find_custom(s_processes, &fdout, (GCompareFunc)abrt_server_compare_fdout);
8f9a28
     if (item == NULL)
8f9a28
     {
8f9a28
-        log_warning("Closing a pipe fd (%d) without a process assigned", fdout);
8f9a28
-        close(fdout);
8f9a28
+        log_warning("Removing an input channel fd (%d) without a process assigned", fdout);
8f9a28
         return FALSE;
8f9a28
     }
8f9a28
 
8f9a28
-- 
8f9a28
2.17.2
8f9a28