Index | Thread | Search

From:
Claudio Jeker <cjeker@diehard.n-r-g.com>
Subject:
Re: [EXT] Re: Kernel protection fault in fill_kproc()
To:
Gerhard Roth <gerhard_roth@genua.de>
Cc:
"mvs@openbsd.org" <mvs@openbsd.org>, "dv@sisu.io" <dv@sisu.io>, "mpi@openbsd.org" <mpi@openbsd.org>, "tech@openbsd.org" <tech@openbsd.org>, Carsten Beckmann <carsten_beckmann@genua.de>
Date:
Wed, 13 Aug 2025 13:49:06 +0200

Download raw body.

Thread
On Wed, Aug 13, 2025 at 11:42:15AM +0000, Gerhard Roth wrote:
> On Wed, 2025-08-13 at 14:32 +0300, Vitaliy Makkoveev wrote:
> > Gerhard, does this diff help?
> 
> Yes, for me this fixes the problem.
> 
> OK gerhard@

Please don't do this. Because depending on the parent the process may
be zapped or not.

Why can't we adjust fill_kproc the way I said it should be done?
 
> 
> > 
> > > 
> > > I propose to do something like below. The corresponding sysctl(2) path
> > > is kernel locked, so the reaper() will wait kernel lock release before
> > > start process teardown and call uvmspace_free(). The copyout() within
> > > sysctl_doproc() will not cause context switch. I didn't test this diff,
> > > but it should work.
> > > 
> > > Index: sys/kern/kern_exit.c
> > > ===================================================================
> > > RCS file: /cvs/src/sys/kern/kern_exit.c,v
> > > diff -u -p -r1.251 kern_exit.c
> > > --- sys/kern/kern_exit.c        3 Jun 2025 08:38:17 -0000       1.251
> > > +++ sys/kern/kern_exit.c        11 Aug 2025 15:38:06 -0000
> > > @@ -497,9 +497,7 @@ reaper(void *arg)
> > >                         proc_free(p);
> > >                 } else {
> > >                         struct process *pr = p->p_p;
> > > -
> > > -                       /* Release the rest of the process's vmspace */
> > > -                       uvm_exit(pr);
> > > +                       struct vmspace *vm = pr->ps_vmspace;
> > >  
> > >                         KERNEL_LOCK();
> > >                         if ((pr->ps_flags & PS_NOZOMBIE) == 0) {
> > > @@ -521,6 +519,9 @@ reaper(void *arg)
> > >                                 process_zap(pr);
> > >                         }
> > >                         KERNEL_UNLOCK();
> > > +
> > > +                       /* Release the rest of the process's vmspace */
> > > +                       uvmspace_free(vm);
> > >                 }
> > >         }
> > >  }
> > > 
> 



-- 
:wq Claudio