merge revision(s) 43112,43114,43117,43118: [Backport #8980]

	* io.c (rb_io_close_read): keep fptr in write_io to be discarded, to
	  fix freed pointer access when it is in use by other threads, and get
	  rid of potential memory/fd leak.

	* io.c (rb_io_close_write): detach tied IO for writing before closing
	  to get rid of race condition.  [ruby-list:49598]

	* io.c (rb_io_close_read): duplex IO should wait its child process
	  even after close_read.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@43482 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 9 insertions, 4 deletions

diff --git a/io.c b/io.c
index 7f1b1112b7..9c2adb22ec 100644
--- a/io.c
+++ b/io.c
@@ -4064,11 +4064,16 @@ rb_io_close_read(VALUE io)
     write_io = GetWriteIO(io);
     if (io != write_io) {
 	rb_io_t *wfptr;
-        rb_io_fptr_cleanup(fptr, FALSE);
 	GetOpenFile(write_io, wfptr);
+	wfptr->pid = fptr->pid;
+	fptr->pid = 0;
         RFILE(io)->fptr = wfptr;
-        RFILE(write_io)->fptr = NULL;
-        rb_io_fptr_finalize(fptr);
+	/* bind to write_io temporarily to get rid of memory/fd leak */
+	fptr->tied_io_for_writing = 0;
+	fptr->mode &= ~FMODE_DUPLEX;
+	RFILE(write_io)->fptr = fptr;
+	rb_io_fptr_cleanup(fptr, FALSE);
+	/* should not finalize fptr because another thread may be reading it */
         return Qnil;
     }
 
@@ -4124,12 +4129,12 @@ rb_io_close_write(VALUE io)
 	rb_raise(rb_eIOError, "closing non-duplex IO for writing");
     }
 
-    rb_io_close(write_io);
     if (io != write_io) {
 	GetOpenFile(io, fptr);
 	fptr->tied_io_for_writing = 0;
 	fptr->mode &= ~FMODE_DUPLEX;
     }
+    rb_io_close(write_io);
     return Qnil;
 }