fork/open race results in wasted fd

[Brian J. Watson]

Two tasks (A & B) share the same files_struct. A calls open() at the same time
as B calls fork(). After A runs get_unused_fd() but before it calls
fd_install(), B runs copy_files().

It looks like the result is one of the bits is set in B's open_fds field with no
corresponding file pointer in its fd array. The fd is unusable, and attempting
to close() it would return EBADF.

Is this a known race?

-Brian (please copy me in response)