From: Vitaliy Makkoveev <mvs@openbsd.org>
Subject: Re: [EXT] Re: Kernel protection fault in fill_kproc()
To: Gerhard Roth <gerhard_roth@genua.de>
Cc: "dv@sisu.io" <dv@sisu.io>, "mpi@openbsd.org" <mpi@openbsd.org>, "tech@openbsd.org" <tech@openbsd.org>, Carsten Beckmann <carsten_beckmann@genua.de>
Date: Wed, 13 Aug 2025 14:32:00 +0300

Gerhard, does this diff help?

> 
> I propose to do something like below. The corresponding sysctl(2) path
> is kernel locked, so the reaper() will wait kernel lock release before
> start process teardown and call uvmspace_free(). The copyout() within
> sysctl_doproc() will not cause context switch. I didn't test this diff,
> but it should work.
> 
> Index: sys/kern/kern_exit.c
> ===================================================================
> RCS file: /cvs/src/sys/kern/kern_exit.c,v
> diff -u -p -r1.251 kern_exit.c
> --- sys/kern/kern_exit.c	3 Jun 2025 08:38:17 -0000	1.251
> +++ sys/kern/kern_exit.c	11 Aug 2025 15:38:06 -0000
> @@ -497,9 +497,7 @@ reaper(void *arg)
>  			proc_free(p);
>  		} else {
>  			struct process *pr = p->p_p;
> -
> -			/* Release the rest of the process's vmspace */
> -			uvm_exit(pr);
> +			struct vmspace *vm = pr->ps_vmspace;
>  
>  			KERNEL_LOCK();
>  			if ((pr->ps_flags & PS_NOZOMBIE) == 0) {
> @@ -521,6 +519,9 @@ reaper(void *arg)
>  				process_zap(pr);
>  			}
>  			KERNEL_UNLOCK();
> +
> +			/* Release the rest of the process's vmspace */
> +			uvmspace_free(vm);
>  		}
>  	}
>  }
>