Race condition in agent/snmpd.c

[Xitsa]

When snmpd is creating a pid file, code uses a sequence open()/fdopen()/fclose()/close(), but close() is unnecessary when fclose() was successful : fdopen: .... The file descriptor is not dup'ed, and will be closed when the stream created by fdopen() is closed.
And if one has an active thread, that tries to open socket/file, it could obtain after call to fclose() the same fd, that will be closed by close().

Main thread:                                                               ZeroMQ I/O thread:
fd = open(pid_file, O_CREAT | O_EXCL | O_WRONLY, 0600); //fd == 2
PID = fdopen(fd, "w");
fclose(PID);
                                                                           fd_ = socket(...); //fd_ == 22
close(fd);
                                                                           int rc = epoll_ctl (_epoll_fd, EPOLL_CTL_ADD, fd_, &pe->ev); //rc = -1
                                                                           if (rc == -1) abort();

In my case I/O thread of zeromq called abort() when had encountered this situation.

[bvanassche]

Thank you for having reported this. A candidate fix has been posted on the net-snmp-coders mailing list and also has been attached to this comment. Please help testing and/or upvoting this patch.
patch.zip

[Xitsa]

The fix amends the problem.

[bvanassche]

A fix has been applied on the v5.9 and master branches. See also commit 26c1d4f.