From: Vitaliy Makkoveev <mvs@openbsd.org>
Subject: Re: [EXT] Re: Kernel protection fault in fill_kproc()
To: Gerhard Roth <gerhard_roth@genua.de>, "dv@sisu.io" <dv@sisu.io>, "mpi@openbsd.org" <mpi@openbsd.org>, "tech@openbsd.org" <tech@openbsd.org>, Carsten Beckmann <carsten_beckmann@genua.de>
Date: Wed, 13 Aug 2025 15:16:10 +0300

On Wed, Aug 13, 2025 at 01:49:06PM +0200, Claudio Jeker wrote:
> On Wed, Aug 13, 2025 at 11:42:15AM +0000, Gerhard Roth wrote:
> > On Wed, 2025-08-13 at 14:32 +0300, Vitaliy Makkoveev wrote:
> > > Gerhard, does this diff help?
> > 
> > Yes, for me this fixes the problem.
> > 
> > OK gerhard@
> 
> Please don't do this. Because depending on the parent the process may
> be zapped or not.
> 

Zapped where? it can't be zapped while you are in the sysctl() path
because kernel lock prevents it. It can be zapped while reaper() calls
uvmspace_free(vm) but this is ok.

> Why can't we adjust fill_kproc the way I said it should be done?
>  
> > 
> > > 
> > > > 
> > > > I propose to do something like below. The corresponding sysctl(2) path
> > > > is kernel locked, so the reaper() will wait kernel lock release before
> > > > start process teardown and call uvmspace_free(). The copyout() within
> > > > sysctl_doproc() will not cause context switch. I didn't test this diff,
> > > > but it should work.
> > > > 
> > > > Index: sys/kern/kern_exit.c
> > > > ===================================================================
> > > > RCS file: /cvs/src/sys/kern/kern_exit.c,v
> > > > diff -u -p -r1.251 kern_exit.c
> > > > --- sys/kern/kern_exit.c        3 Jun 2025 08:38:17 -0000       1.251
> > > > +++ sys/kern/kern_exit.c        11 Aug 2025 15:38:06 -0000
> > > > @@ -497,9 +497,7 @@ reaper(void *arg)
> > > >                         proc_free(p);
> > > >                 } else {
> > > >                         struct process *pr = p->p_p;
> > > > -
> > > > -                       /* Release the rest of the process's vmspace */
> > > > -                       uvm_exit(pr);
> > > > +                       struct vmspace *vm = pr->ps_vmspace;
> > > >  
> > > >                         KERNEL_LOCK();
> > > >                         if ((pr->ps_flags & PS_NOZOMBIE) == 0) {
> > > > @@ -521,6 +519,9 @@ reaper(void *arg)
> > > >                                 process_zap(pr);
> > > >                         }
> > > >                         KERNEL_UNLOCK();
> > > > +
> > > > +                       /* Release the rest of the process's vmspace */
> > > > +                       uvmspace_free(vm);
> > > >                 }
> > > >         }
> > > >  }
> > > > 
> > 
> 
> 
> 
> -- 
> :wq Claudio