ia64/xen-unstable

changeset 15684:425c3d6f7557

Fix file descriptor leak in blktapctrl

The blktapctrl process is responsible for spawning individual tapdisk
processes. It does this using the 'system' method, but unfortunately
none of its file descriptors have the close-on-exec flag set. The
parent blktapctl process opens a couple of unix domain sockets
per-tapdisk it spawns. So the first tapdisk get 2 FDs leaked to it,
the second gets 4 FDs leaked to it, the 3rd gets 6 and so on. The use
of 'system' also unneccessarily invokes the shell.

Replace system with fork/execvp, and explicitly close all file handles
up to _SC_OPEN_MAX.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
author kfraser@localhost.localdomain
date Wed Aug 01 09:04:20 2007 +0100 (2007-08-01)
parents 36caf6f84072
children ad9a79db3839
files tools/blktap/drivers/blktapctrl.c
line diff
     1.1 --- a/tools/blktap/drivers/blktapctrl.c	Wed Aug 01 08:59:03 2007 +0100
     1.2 +++ b/tools/blktap/drivers/blktapctrl.c	Wed Aug 01 09:04:20 2007 +0100
     1.3 @@ -42,6 +42,7 @@
     1.4  #include <errno.h>
     1.5  #include <sys/types.h>
     1.6  #include <linux/types.h>
     1.7 +#include <sys/wait.h>
     1.8  #include <signal.h>
     1.9  #include <fcntl.h>
    1.10  #include <sys/poll.h>
    1.11 @@ -472,11 +473,38 @@ static int read_msg(int fd, int msgtype,
    1.12  
    1.13  }
    1.14  
    1.15 +int launch_tapdisk(char *wrctldev, char *rdctldev)
    1.16 +{
    1.17 +	char *argv[] = { "tapdisk", wrctldev, rdctldev, NULL };
    1.18 +	pid_t child;
    1.19 +	
    1.20 +	if ((child = fork()) < 0)
    1.21 +		return -1;
    1.22 +
    1.23 +	if (!child) {
    1.24 +		int i;
    1.25 +		for (i = 0 ; i < sysconf(_SC_OPEN_MAX) ; i++)
    1.26 +			if (i != STDIN_FILENO &&
    1.27 +			    i != STDOUT_FILENO &&
    1.28 +			    i != STDERR_FILENO)
    1.29 +				close(i);
    1.30 +
    1.31 +		execvp("tapdisk", argv);
    1.32 +		_exit(1);
    1.33 +	} else {
    1.34 +		pid_t got;
    1.35 +		do {
    1.36 +			got = waitpid(child, NULL, 0);
    1.37 +		} while (got != child);
    1.38 +	}
    1.39 +	return 0;
    1.40 +}
    1.41 +
    1.42  int blktapctrl_new_blkif(blkif_t *blkif)
    1.43  {
    1.44  	blkif_info_t *blk;
    1.45  	int major, minor, fd_read, fd_write, type, new;
    1.46 -	char *rdctldev, *wrctldev, *cmd, *ptr;
    1.47 +	char *rdctldev, *wrctldev, *ptr;
    1.48  	image_t *image;
    1.49  	blkif_t *exist = NULL;
    1.50  	static uint16_t next_cookie = 0;
    1.51 @@ -504,12 +532,6 @@ int blktapctrl_new_blkif(blkif_t *blkif)
    1.52  				free(rdctldev);
    1.53  				return -1;
    1.54  			}
    1.55 -			if (asprintf(&cmd, "tapdisk %s %s", wrctldev, rdctldev) == -1) {
    1.56 -				free(rdctldev);
    1.57 -				free(wrctldev);
    1.58 -				return -1;
    1.59 -			}
    1.60 -
    1.61  			blkif->fds[READ] = open_ctrl_socket(rdctldev);
    1.62  			blkif->fds[WRITE] = open_ctrl_socket(wrctldev);
    1.63  			
    1.64 @@ -517,15 +539,14 @@ int blktapctrl_new_blkif(blkif_t *blkif)
    1.65  				goto fail;
    1.66  
    1.67  			/*launch the new process*/
    1.68 -			DPRINTF("Launching process, CMDLINE [%s]\n",cmd);
    1.69 -			if (system(cmd) == -1) {
    1.70 -				DPRINTF("Unable to fork, cmdline: [%s]\n",cmd);
    1.71 + 			DPRINTF("Launching process, CMDLINE [tapdisk %s %s]\n",wrctldev, rdctldev);
    1.72 + 			if (launch_tapdisk(wrctldev, rdctldev) == -1) {
    1.73 + 				DPRINTF("Unable to fork, cmdline: [tapdisk %s %s]\n",wrctldev, rdctldev);
    1.74  				return -1;
    1.75  			}
    1.76  
    1.77  			free(rdctldev);
    1.78  			free(wrctldev);
    1.79 -			free(cmd);
    1.80  		} else {
    1.81  			DPRINTF("Process exists!\n");
    1.82  			blkif->fds[READ] = exist->fds[READ];
    1.83 @@ -605,7 +626,6 @@ int open_ctrl_socket(char *devname)
    1.84  {
    1.85  	int ret;
    1.86  	int ipc_fd;
    1.87 -	char *cmd;
    1.88  	fd_set socks;
    1.89  	struct timeval timeout;
    1.90