diff options
| author | Aaron Campbell <aaron@cvs.openbsd.org> | 2005-10-13 18:17:16 +0000 |
|---|---|---|
| committer | Aaron Campbell <aaron@cvs.openbsd.org> | 2005-10-13 18:17:16 +0000 |
| commit | 56443547fc26c29550460c4dc03c72dfa8b8d01c (patch) | |
| tree | 07e34410a88074fc729a3b319e8d8ca6d916f1b0 /sys | |
| parent | 35182740a9b22fcb144291823d0d222d79d36116 (diff) | |
In realitexpire(), do not re-add the itimer timeout if the process is in
the midst of exiting. This solves a race condition that causes freed memory
to be left referenced in the master kernel timeout worklist, leading to a
uvm_fault. The same race condition was already fixed earlier in r1.53 of
kern_clock.c for the process virtual and profile timeout structs.
deraadt@ ok, testing by krw@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/kern_time.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c index 2ed842aab04..d120439768c 100644 --- a/sys/kern/kern_time.c +++ b/sys/kern/kern_time.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_time.c,v 1.49 2005/10/10 07:23:02 otto Exp $ */ +/* $OpenBSD: kern_time.c,v 1.50 2005/10/13 18:17:15 aaron Exp $ */ /* $NetBSD: kern_time.c,v 1.20 1996/02/18 11:57:06 fvdl Exp $ */ /* @@ -617,7 +617,8 @@ realitexpire(arg) timo = tvtohz(&ntv) - 1; if (timo <= 0) timo = 1; - timeout_add(&p->p_realit_to, timo); + if ((p->p_flag & P_WEXIT) == 0) + timeout_add(&p->p_realit_to, timo); return; } } |