From nobody Wed Aug 19 21:03:57 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hQJvx42H1z6pfW3 for ; Wed, 19 Aug 2026 21:03:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hQJvx370gz3llN for ; Wed, 19 Aug 2026 21:03:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787173437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1CQrlyKzHSytjbcZtjsGn5x1CbE/1ptCmkzhDqUqZA8=; b=SskowVxzy5F9jFNOcqT/SXV/vYX5P5cBhqRBJr040/T49h16Omvv15IbU/4vaLdqCRCErd JHoJIi7siQBBe8sM6opoNiHmA9nvWqBMKoB/TL2HrblZ41p5bhDqb9mYncXb+Gep1TAf3H 6x18Q6+gfHWPu6ARqAUsBEFdzc5jDbKPpvQIxeILOp52URXDPIYcqHhhOUfK1fZrtwtJ6v OhYrR9B7/1HVrkjw9outpZ9pNnq0NN/CJz3LaOhTfd29IiCrID3OLol9Tp5TOfLqFz8VPH oI8L8/E2/WhBX8VTtGgbmtzqPtME8nJ1B10T4vPjTff2Gk9gA4eaPIWidzQBGg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787173437; a=rsa-sha256; cv=none; b=Ohj6d5x9ZGvWghL2quVmCoGMTZHGj/JbikrnsuNbIR56tW+V89a9xqLozNyRZkD77LVqkP 435okzsHmE8h6O8dETbNK23wTiiwc8Ef/3dmEQmHeBLhb3XlFFOkCjkAgvCf1JSQ+15Y5e KEDjYy+J+JWTQ1CPJUIyl6Ui0t4steyMLB7xDTOUxYiUmZB0y30x0p8zZ8jqkKCeVIPF4b deBVZ35sCyAUXTA34mEsg5gTXzhp0AyvzdJ49sCmjlZdTgZ+vB/vkTDIyrOoYuC8Vn6cbJ MNd6CiVnOybJ5GP86p8aSpE5voC/g59WjVHmM3ltleibBJCSz7Lqym/hhOQZGw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787173437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1CQrlyKzHSytjbcZtjsGn5x1CbE/1ptCmkzhDqUqZA8=; b=kG8nRKedOl7w+kyEYqwQpP70DKRfwMqJv9vERertM0pwdeRW0cAAIsmVgli2MaABALyOkF nLcbUYVPdSIba8vmSGFhxXdg1k08qrh8nZDmJ9aChetkQ93Xy6ejGrWHbXV9hxl4j7QeyN iK241213ddXyk6yADEQ+SdsW5AZzw+fPBzKjc3ZRYKfzsxNtx+sx1ldY0LjWcEeie/Px7d MsWaU70brZVLbV1tro25MICBeSKEuy5YhFwuMTH+JbeXeySMj4g+l4Bco/9mviVJ/CE/nM IUMiGef61X9m1PvrQdJYVX03Wt9DesVuXt9+xTpJabXmgqehxvpfX7wFV5I5wA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hQJvx1vBXznqp for ; Wed, 19 Aug 2026 21:03:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 31e9f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 19 Aug 2026 21:03:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: fb0af871db68 - stable/14 - proc: Copy the p_reapsubtree field explicitly during fork List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: fb0af871db6820862a1a0bbfe56a43c0446e40b3 Auto-Submitted: auto-generated Date: Wed, 19 Aug 2026 21:03:57 +0000 Message-Id: <6a861a3d.31e9f.31bf506e@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=fb0af871db6820862a1a0bbfe56a43c0446e40b3 commit fb0af871db6820862a1a0bbfe56a43c0446e40b3 Author: Mark Johnston AuthorDate: 2026-07-27 23:03:47 +0000 Commit: Mark Johnston CommitDate: 2026-08-19 18:08:59 +0000 proc: Copy the p_reapsubtree field explicitly during fork p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc, which is copied during fork without any synchronization. However, the field is not stable except when the proctree lock is held, and indeed may change if p1's reaper exits or explicitly releases its reaper status. This state change can race with fork() and leave the child with an incorrect p_reapsubtree field. Close the race: explicitly copy the field under the proctree lock during fork. Reported by: syzkaller Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58482 (cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b) --- sys/kern/kern_fork.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index d8578f01677b..7b566ebffa8c 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -656,6 +656,13 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * if (p2->p_reaper == p1 && p1 != initproc) { p2->p_reapsubtree = p2->p_pid; proc_id_set_cond(PROC_ID_REAP, p2->p_pid); + } else { + /* + * Explicitly copy this field under the proctree lock, as it + * might have changed since the bulk copying of the parent's + * fields. + */ + p2->p_reapsubtree = p1->p_reapsubtree; } sx_xunlock(&proctree_lock);