From 7a8c7564ba1e0e2217d05c5b1222be3add308b53 Mon Sep 17 00:00:00 2001 From: Red Bear OS Date: Tue, 14 Jul 2026 16:37:24 +0900 Subject: [PATCH] fix(spawn): leak child thread fd to prevent race with dynamic linker posix_spawn creates a new context and returns its thread fd to the parent. The kernel currently does not keep a self-reference to the child context's thread fd, so when the parent closes its handle, the child's thread object may be destroyed before the dynamic linker reads AT_REDOX_THR_FD from auxv and opens regs/env. Leak the parent handle until the kernel is fixed to retain a reference per context. --- src/platform/redox/mod.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/platform/redox/mod.rs b/src/platform/redox/mod.rs index efd35d15d3..ffb629d97f 100644 --- a/src/platform/redox/mod.rs +++ b/src/platform/redox/mod.rs @@ -1483,6 +1483,13 @@ impl Pal for Sys { let start_fd = child.thr_fd.dup_into_upper(b"start")?; start_fd.write(&[0])?; + // The kernel does not keep a self-reference to the new context's thread + // fd. If the parent closes its handle before the child reads AT_REDOX_THR_FD + // from auxv and creates its own reference, the child thread object is + // destroyed and the dynamic linker panics trying to open regs/env. Until + // the kernel holds a reference per context, leak the parent handle. + let _ = child.thr_fd.take(); + Ok(pid_t::try_from(child.pid).unwrap()) }