When allocating the unallocated file descriptors 0, 1 and 2 for suid execs,

don't do it by doing namei on /dev/null.

The vnode for the executed file is locked and we had a race where other
processes could lock the parent directories up to the root. When the
executing process did the lookup on /dev/null it could deadlock on the
root vnode while still holding the lock on the executed vnode.

Also, it's really bad idea to depend on certain filesystem layout inside
the kernel. Now we get the null device vnode by cdevvp(getnulldev(), ...

Thanks to Matrin Portmann <map@infinitum.ch> for providing the (large)
ktrace that allowed me to track this down.

Fixes 1369.

0 files changed, 0 insertions, 0 deletions