From: Gerhard Roth <gerhard_roth@genua.de>
Subject: Re: [EXT] Re: Kernel protection fault in fill_kproc()
To: "mvs@openbsd.org" <mvs@openbsd.org>
Cc: "dv@sisu.io" <dv@sisu.io>, "mpi@openbsd.org" <mpi@openbsd.org>, "tech@openbsd.org" <tech@openbsd.org>, Carsten Beckmann <carsten_beckmann@genua.de>
Date: Wed, 13 Aug 2025 11:42:15 +0000

On Wed, 2025-08-13 at 14:32 +0300, Vitaliy Makkoveev wrote:
> Gerhard, does this diff help?

Yes, for me this fixes the problem.

OK gerhard@


> 
> > 
> > I propose to do something like below. The corresponding sysctl(2) path
> > is kernel locked, so the reaper() will wait kernel lock release before
> > start process teardown and call uvmspace_free(). The copyout() within
> > sysctl_doproc() will not cause context switch. I didn't test this diff,
> > but it should work.
> > 
> > Index: sys/kern/kern_exit.c
> > ===================================================================
> > RCS file: /cvs/src/sys/kern/kern_exit.c,v
> > diff -u -p -r1.251 kern_exit.c
> > --- sys/kern/kern_exit.c        3 Jun 2025 08:38:17 -0000       1.251
> > +++ sys/kern/kern_exit.c        11 Aug 2025 15:38:06 -0000
> > @@ -497,9 +497,7 @@ reaper(void *arg)
> >                         proc_free(p);
> >                 } else {
> >                         struct process *pr = p->p_p;
> > -
> > -                       /* Release the rest of the process's vmspace */
> > -                       uvm_exit(pr);
> > +                       struct vmspace *vm = pr->ps_vmspace;
> >  
> >                         KERNEL_LOCK();
> >                         if ((pr->ps_flags & PS_NOZOMBIE) == 0) {
> > @@ -521,6 +519,9 @@ reaper(void *arg)
> >                                 process_zap(pr);
> >                         }
> >                         KERNEL_UNLOCK();
> > +
> > +                       /* Release the rest of the process's vmspace */
> > +                       uvmspace_free(vm);
> >                 }
> >         }
> >  }
> >