From nobody Tue Apr 15 02:25:38 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Zc7LC2F3fz5sjTQ; Tue, 15 Apr 2025 02:25:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Zc7LC0KC3z3MBc; Tue, 15 Apr 2025 02:25:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744683939; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FQi48Nwe9cfUMPrmAvjA5dUIg3PH3OASlTe+sdCl1Xc=; b=C7dcMpete43KGJkBAehtWDjVYnWYinw2V4kFxWiuQjoz9xV99nggpmQO+Q68gXl5BG9M28 1nJCpOeW5G4nNmd1VpL3k1HZj6GIb2qfLelYAMdqWXX0Kz4UqBJBxjDgp4mKaYwfTSaJrE KXqu/8HO8gAunXt3X7BA5W+Sl+sVqxD2HY8Q3gWLN0RP2Up0AA6pj+cwG7PLhJcqdBv8s7 G3WQTI5Ui9mV8DvOiZt0ZJssKzCV1OkZubIHTfYMwvoo/rjX6bL3fZtDiYVCOespWugJFK xmX8BHbM4LD4EoFaLKwvQzWx/rKMaTI0BKS+pyFVuw08PzDmyN5jdNiBJwEkHg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1744683939; a=rsa-sha256; cv=none; b=rlBXSMuuFs1RhkUB5b9sQjWBBJ3hfYU1kBfYgusrabAF15zq8jk+jJX1h3WeAby0ccIiC+ brj9Sn4G6ObZYxRBKQZHuZVrxQ5ehOKr8FOsbWL1MjlNM9kPglPhhT7XVahnBNJv943EQl c2CPDkXCEq8cLqYOMkUgmWIRkrQ0EDAhGwDTcBfHoLQLdJQz3ciYlcHFt7MKRmZrtLZU7g lfEDozrXd6JRTnddhMeSwcqETM+3prXEpNVip88Q6rZBb3yezmEZ+Pnaz3FrcPfrCgSPIa jOWsKHfTOUAOCRv942QtkYrAMUOACB+mc4xQ5YLDt9rPZLYQg5kyx0KjIDeeKA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744683939; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FQi48Nwe9cfUMPrmAvjA5dUIg3PH3OASlTe+sdCl1Xc=; b=bfY4hw0tkP0GmjR6n+vByzic9E9otpfy9YfL4dn8yMt3GmGJQTOJieNhhZKkxnumMgPaUX XrCpWtlQjnR4WI8d9iFfCSY8++DuOQjVC2sVOXCFzxY6I9E27Y6ECJqbDye4izuWgnhuPo QmjhlBXG8eC9yBFWvNTHQ+uDJK4oae2HKBY89gEcVQuYZNwj8LLzdHsKEybe3OSlpLgxgL Oh0hAuh2jkPQ3HTcYI2XiCpshkX6KQvNIcTSHl5lEiGtZbYoHYr/HFdOMCKZx83HUynYmj QBxE2qvEVAyiRciTFe6+URCBuuG4MLYIm3NPcA/Jr1PsfufpJItVFteUgXr06A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Zc7LB6llYz8K; Tue, 15 Apr 2025 02:25:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53F2Pcaf014664; Tue, 15 Apr 2025 02:25:38 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53F2PcsP014660; Tue, 15 Apr 2025 02:25:38 GMT (envelope-from git) Date: Tue, 15 Apr 2025 02:25:38 GMT Message-Id: <202504150225.53F2PcsP014660@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 693664482649 - stable/14 - proc: Disallow re-enabling of process itimers during exit List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 69366448264956c18d0b46f900593442ed8e79ba Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=69366448264956c18d0b46f900593442ed8e79ba commit 69366448264956c18d0b46f900593442ed8e79ba Author: Mark Johnston AuthorDate: 2025-03-31 01:22:14 +0000 Commit: Mark Johnston CommitDate: 2025-04-15 02:25:24 +0000 proc: Disallow re-enabling of process itimers during exit During process exit, it's possible for the exiting thread to send a signal to its process, via killjobc(). This happens after the itimer is drained. If itimers are stopped, i.e., P2_ITSTOPPED is set, then itimer_proc_continue() will resume the callout after it has been drained. Fix the problem by simply clearing P2_ITSTOPPED as part of the drain. Then, a signal received after that point will not re-enable the callout. For good measure, also make sure that we don't reset the itimer callout in an exiting process. Reported by: syzkaller Reviewed by: kib MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D49529 (cherry picked from commit a6268f89d58c1962d2372a664a35eaecbf367fbb) --- sys/kern/kern_exit.c | 1 + sys/kern/kern_time.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index 788b58da450d..0c3070f2e360 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -377,6 +377,7 @@ exit1(struct thread *td, int rval, int signo) * Stop the real interval timer. If the handler is currently * executing, prevent it from rearming itself and let it finish. */ + p->p_flag2 &= ~P2_ITSTOPPED; if (timevalisset(&p->p_realtimer.it_value) && callout_stop(&p->p_itcallout) == 0) { timevalclear(&p->p_realtimer.it_interval); diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c index d109dbb509dd..000394d7f4b8 100644 --- a/sys/kern/kern_time.c +++ b/sys/kern/kern_time.c @@ -885,6 +885,8 @@ realitexpire_reset_callout(struct proc *p, sbintime_t *isbtp) { sbintime_t prec; + if ((p->p_flag & P_WEXIT) != 0) + return; prec = isbtp == NULL ? tvtosbt(p->p_realtimer.it_interval) : *isbtp; callout_reset_sbt(&p->p_itcallout, tvtosbt(p->p_realtimer.it_value), prec >> tc_precexp, realitexpire, p, C_ABSOLUTE);