Skip to content

Commit bc71817

Browse files
committed
do_fork_exec(): Drop status pipe
The status pipe was closed by fix_fds(), so all of the subsequent operations on it were operating on a closed file descriptor. If exec_func() returned, the subsequent write() would operate on a file descriptor that might have been reused for another purpose, but none of the registered execution functions ever returned. Just call abort() if they do return.
1 parent acda549 commit bc71817

File tree

1 file changed

+8
-28
lines changed

1 file changed

+8
-28
lines changed

libqrexec/exec.c

+8-28
Original file line numberDiff line numberDiff line change
@@ -112,53 +112,33 @@ static int do_fork_exec(const char *user,
112112
int *stdout_fd,
113113
int *stderr_fd)
114114
{
115-
int inpipe[2], outpipe[2], errpipe[2], statuspipe[2], retval;
115+
int inpipe[2], outpipe[2], errpipe[2], retval;
116116
#ifndef SOCK_CLOEXEC
117117
#define SOCK_CLOEXEC 0
118118
#endif
119-
if (socketpair(AF_UNIX, SOCK_STREAM, 0, inpipe) ||
120-
socketpair(AF_UNIX, SOCK_STREAM, 0, outpipe) ||
121-
(stderr_fd && socketpair(AF_UNIX, SOCK_STREAM, 0, errpipe)) ||
122-
socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, statuspipe)) {
119+
if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, inpipe) ||
120+
socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, outpipe) ||
121+
(stderr_fd && socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, errpipe))) {
123122
PERROR("socketpair");
124123
exit(1);
125124
}
126125
switch (*pid = fork()) {
127126
case -1:
128127
PERROR("fork");
129128
exit(-1);
130-
case 0: {
131-
int status;
129+
case 0:
132130
if (signal(SIGPIPE, SIG_DFL) == SIG_ERR)
133131
abort();
134132
if (stderr_fd) {
135133
fix_fds(inpipe[0], outpipe[1], errpipe[1]);
136134
} else
137135
fix_fds(inpipe[0], outpipe[1], 2);
138136

139-
close(statuspipe[0]);
140-
if (SOCK_CLOEXEC == (0)) {
141-
status = fcntl(statuspipe[1], F_GETFD);
142-
fcntl(statuspipe[1], F_SETFD, status | FD_CLOEXEC);
143-
}
144137
if (exec_func != NULL)
145138
exec_func(cmdline, user);
146-
else
147-
abort();
148-
status = errno;
149-
while (write(statuspipe[1], &status, sizeof status) <= 0) {}
150-
_exit(-1);
151-
}
152-
default: {
153-
close(statuspipe[1]);
154-
if (read(statuspipe[0], &retval, sizeof retval) == sizeof retval) {
155-
siginfo_t siginfo;
156-
memset(&siginfo, 0, sizeof siginfo);
157-
waitid(P_PID, *pid, &siginfo, WEXITED); // discard result
158-
} else {
159-
retval = 0;
160-
}
161-
}
139+
abort();
140+
default:
141+
retval = 0;
162142
}
163143
close(inpipe[0]);
164144
close(outpipe[1]);

0 commit comments

Comments
 (0)