git: 7e6d8a8b8fb6 - stable/15 - proc: Copy the p_reapsubtree field explicitly during fork

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=7e6d8a8b8fb66597f30067b6eb56b1c0a6ac2d50

commit 7e6d8a8b8fb66597f30067b6eb56b1c0a6ac2d50
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-27 23:03:47 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-17 12:07:41 +0000

    proc: Copy the p_reapsubtree field explicitly during fork
    
    p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
    which is copied during fork without any synchronization.  However, the
    field is not stable except when the proctree lock is held, and indeed
    may change if p1's reaper exits or explicitly releases its reaper
    status.  This state change can race with fork() and leave the child with
    an incorrect p_reapsubtree field.
    
    Close the race: explicitly copy the field under the proctree lock during
    fork.
    
    Reported by:    syzkaller
    Reviewed by:    kib
    MFC after:      2 weeks
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58482
    
    (cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b)
---
 sys/kern/kern_fork.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index 3c8193542eb2..9bdaca27f4e1 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -709,6 +709,13 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread *
 	if (p2->p_reaper == p1 && p1 != initproc) {
 		p2->p_reapsubtree = p2->p_pid;
 		proc_id_set_cond(PROC_ID_REAP, p2->p_pid);
+	} else {
+		/*
+		 * Explicitly copy this field under the proctree lock, as it
+		 * might have changed since the bulk copying of the parent's
+		 * fields.
+		 */
+		p2->p_reapsubtree = p1->p_reapsubtree;
 	}
 	sx_xunlock(&proctree_lock);