From f74212ae0052b00828bcf7201ca3afa4dead4530 Mon Sep 17 00:00:00 2001

From: Martin Kutlak <mkutlak@redhat.com>

Date: Thu, 20 Sep 2018 16:49:28 +0200

Subject: [PATCH] daemon: Fix double closed fd race condition

When a communication channel is set up between abrtd and abrt-server it uses

abrt_gio_channel_unix_new(). In that function there is a call g_io_channel_set_close_on_unref() [1].

This function sets whether to close a file/socket/whatever associated with the channel when channel

recieves a final unref and is to be destroyed.

Calling a close() on fd associated with the channel before/after g_io_channel_unref()

created a double close() race condition when ABRT was processing a lot of crashes at the same time.

Thank you benzea for the patch.

Related rhbz#1655241

1 - https://developer.gnome.org/glib/stable/glib-IO-Channels.html#g-io-channel-get-close-on-unref

(cherry picked from github.com/abrt/abrt/commit/d965a43042b11eaed00ca49fcb060592082c398c)

Signed-off-by: Martin Kutlak <mkutlak@redhat.com>

---

 src/daemon/abrt-server.c | 1 -

 src/daemon/abrtd.c       | 4 +---

 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/daemon/abrt-server.c b/src/daemon/abrt-server.c

index 76186db76..e1dfc4af8 100644

--- a/src/daemon/abrt-server.c

+++ b/src/daemon/abrt-server.c

@@ -294,7 +294,6 @@ static int run_post_create(const char *dirname)

     g_main_loop_unref(context.main_loop);

     g_io_channel_unref(channel_signal);

     close(g_signal_pipe[1]);

-    close(g_signal_pipe[0]);

     log_notice("Waiting finished");

diff --git a/src/daemon/abrtd.c b/src/daemon/abrtd.c

index fc4f01e22..0c63e7260 100644

--- a/src/daemon/abrtd.c

+++ b/src/daemon/abrtd.c

@@ -109,7 +109,6 @@ static void stop_abrt_server(struct abrt_server_proc *proc)

 static void dispose_abrt_server(struct abrt_server_proc *proc)

 {

-    close(proc->fdout);

     free(proc->dirname);

     if (proc->watch_id > 0)

@@ -226,8 +225,7 @@ static gboolean abrt_server_output_cb(GIOChannel *channel, GIOCondition conditio

     GList *item = g_list_find_custom(s_processes, &fdout, (GCompareFunc)abrt_server_compare_fdout);

     if (item == NULL)

     {

-        log_warning("Closing a pipe fd (%d) without a process assigned", fdout);

-        close(fdout);

+        log_warning("Removing an input channel fd (%d) without a process assigned", fdout);

         return FALSE;

     }

-- 

2.17.2