Download raw body.
[EXT] Re: Kernel protection fault in fill_kproc()
On Wed, Aug 13, 2025 at 01:49:06PM +0200, Claudio Jeker wrote:
> On Wed, Aug 13, 2025 at 11:42:15AM +0000, Gerhard Roth wrote:
> > On Wed, 2025-08-13 at 14:32 +0300, Vitaliy Makkoveev wrote:
> > > Gerhard, does this diff help?
> >
> > Yes, for me this fixes the problem.
> >
> > OK gerhard@
>
> Please don't do this. Because depending on the parent the process may
> be zapped or not.
>
Zapped where? it can't be zapped while you are in the sysctl() path
because kernel lock prevents it. It can be zapped while reaper() calls
uvmspace_free(vm) but this is ok.
> Why can't we adjust fill_kproc the way I said it should be done?
>
> >
> > >
> > > >
> > > > I propose to do something like below. The corresponding sysctl(2) path
> > > > is kernel locked, so the reaper() will wait kernel lock release before
> > > > start process teardown and call uvmspace_free(). The copyout() within
> > > > sysctl_doproc() will not cause context switch. I didn't test this diff,
> > > > but it should work.
> > > >
> > > > Index: sys/kern/kern_exit.c
> > > > ===================================================================
> > > > RCS file: /cvs/src/sys/kern/kern_exit.c,v
> > > > diff -u -p -r1.251 kern_exit.c
> > > > --- sys/kern/kern_exit.c 3 Jun 2025 08:38:17 -0000 1.251
> > > > +++ sys/kern/kern_exit.c 11 Aug 2025 15:38:06 -0000
> > > > @@ -497,9 +497,7 @@ reaper(void *arg)
> > > > proc_free(p);
> > > > } else {
> > > > struct process *pr = p->p_p;
> > > > -
> > > > - /* Release the rest of the process's vmspace */
> > > > - uvm_exit(pr);
> > > > + struct vmspace *vm = pr->ps_vmspace;
> > > >
> > > > KERNEL_LOCK();
> > > > if ((pr->ps_flags & PS_NOZOMBIE) == 0) {
> > > > @@ -521,6 +519,9 @@ reaper(void *arg)
> > > > process_zap(pr);
> > > > }
> > > > KERNEL_UNLOCK();
> > > > +
> > > > + /* Release the rest of the process's vmspace */
> > > > + uvmspace_free(vm);
> > > > }
> > > > }
> > > > }
> > > >
> >
>
>
>
> --
> :wq Claudio
[EXT] Re: Kernel protection fault in fill_kproc()