os: StartProcess fails to keep Files alive after converting to []uintptr array

[mdempsky]

As noted during discussion of #34810, os.StartProcess fails to use runtime.KeepAlive to ensure attr.Files stays alive past the call to syscall.StartProcess. As a consquence, the os.Files might be garbage collected, and the FDs can be reclaimed before they're used.

Below is a proof of concept of this issue (it fails most runs, but not always):

$ go run x.go
panic: 58 fork/exec /bin/true: bad file descriptor

goroutine 1 [running]:
main.main()
	/tmp/x.go:25 +0x2f6
exit status 2

$ cat x.go
package main

import (
	"fmt"
	"os"
	"runtime"
)

func main() {
	go func() {
		for {
			runtime.GC()
		}
	}()

	for i := 0; i < 100; i++ {
		p, err := os.StartProcess("/bin/true", nil, &os.ProcAttr{
			Files: []*os.File{
				mustOpen("/dev/null"),
				mustOpen("/dev/null"),
				mustOpen("/dev/null"),
			},
		})
		if err != nil {
			panic(fmt.Sprint(i, err))
		}
		p.Release()
	}
}

func mustOpen(name string) *os.File {
	f, err := os.Open(name)
	if err != nil {
		panic(err)
	}
	return f
}

/cc @ianlancetaylor

[gopherbot]

Change https://golang.org/cl/201198 mentions this issue: os: keep attr.Files alive when calling StartProcess