Fix fd race conditions (during shared fd table usage.) Badfileops is

now used in f_ops in place of NULL, and modifications to the files
are more carefully ordered. f_ops should also be set to &badfileops
upon "close" of a file.

This does not fix other problems mentioned in this PR than the first
one.

PR:		11629
Reviewed by:	peter

1 files changed, 6 insertions, 5 deletions

diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
index a7266eb91ce0..06b897f69a91 100644
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -16,7 +16,7 @@
  * 4. Modifications may be freely made to this file if the above conditions
  *    are met.
  *
- * $Id: sys_pipe.c,v 1.51 1999/04/04 21:41:15 dt Exp $
+ * $Id: sys_pipe.c,v 1.52 1999/06/05 03:53:57 alc Exp $
  */
 
 /*
@@ -176,15 +176,15 @@ pipe(p, uap)
 	p->p_retval[0] = fd;
 	rf->f_flag = FREAD | FWRITE;
 	rf->f_type = DTYPE_PIPE;
-	rf->f_ops = &pipeops;
 	rf->f_data = (caddr_t)rpipe;
+	rf->f_ops = &pipeops;
 	error = falloc(p, &wf, &fd);
 	if (error)
 		goto free3;
 	wf->f_flag = FREAD | FWRITE;
 	wf->f_type = DTYPE_PIPE;
-	wf->f_ops = &pipeops;
 	wf->f_data = (caddr_t)wpipe;
+	wf->f_ops = &pipeops;
 	p->p_retval[1] = fd;
 
 	rpipe->pipe_peer = wpipe;
@@ -192,8 +192,8 @@ pipe(p, uap)
 
 	return (0);
 free3:
-	ffree(rf);
 	fdp->fd_ofiles[p->p_retval[0]] = 0;
+	ffree(rf);
 free2:
 	(void)pipeclose(wpipe);
 	(void)pipeclose(rpipe);
@@ -1039,9 +1039,10 @@ pipe_close(fp, p)
 {
 	struct pipe *cpipe = (struct pipe *)fp->f_data;
 
+	fp->f_ops = &badfileops;
+	fp->f_data = NULL;
 	funsetown(cpipe->pipe_sigio);
 	pipeclose(cpipe);
-	fp->f_data = NULL;
 	return 0;
 }