From nobody Thu Aug 20 17:53:54 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hQrfB4MGVz6pF9W for ; Thu, 20 Aug 2026 17:53:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hQrfB1Xg8z41SD for ; Thu, 20 Aug 2026 17:53:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787248434; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=spDhU4II83r7BIypL5t4Lq1oFd67z1xjx5rDwqchu4A=; b=W3fIYO01fTL0/A85U4Of8y2gRAmb1KGLK1kwGM+9muIouQHWPDzBwXLvqaQuzKucyF+b1x WNzHgAVr5e7VOJQci0HN3+rMomWujM6i47szYV+AIQbE2KcXM2GYhyCBJJYblFH0oHhzXt AKg1kmMvNX+HtGaXYds62fwfB2lrMK2NFqLPG9t9NlMs60E9cWrWTvn5rtP3//vMYkPNSQ IsEnerPlSuTOXgoXhkBv0r8fHHlWcNj/btIBAE/rTMMU5B6Q+ExrDsj64N45ByGBwc0hmi 8pt0wcWvgzs8/Wbagjr9/N3kxwgypLE3cySP0ij/3HQxSuXA0AH6MRbteHN/3A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787248434; a=rsa-sha256; cv=none; b=pBYR30TN6lwL1hJ+rlMeg1V4jbmj6thwNh+05S7yGzheiHwk/DJRr3U9MBvbYEO/WMlv4C p0VTdYJmDPu4K+Dmdq4gjeOVXmqcLv2v7lwspV9HrbKGZyeQUFWr6TBg7Whc1ySsRSKEK8 M7ehxJN/dtYffS201uHP8E4mHLeDa2AOyDlVToc4jnxgC5vIhw5StIt9G7A46HtKiKH4lt XtvNixufi7D/YWPInwU/V/6WmlQvcPB/JU0q7tfN4qulFHn/hfZkobI7EBCA4x2gpYjp/O /q5UC5LC0mq7qEGHY+fITXMf87/U4SoW5SLn7CqoUvNvJlRYWPw31PEB+nUZmQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787248434; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=spDhU4II83r7BIypL5t4Lq1oFd67z1xjx5rDwqchu4A=; b=k7gLhLqPVsXE7S25/6672D8FGhmiNMeB8bWyqDxgPBJ+BD6RTP/2lP6ZSQDwrlBgIkNmbi Fh2HhbN0Od6Bsp2b0SOiDvPdWoWV/1rWfRLezFCrmwaxpQJr46JOpDN/SrH95DQcscbXNv 37XsUNtsKB/nX8tS0u807Kh0EBwGxZ6qg4QWHjmowS72VYgchwHxzzNtN9bdb95zu637ny 2eM7gDz79BBjb/OvR0DSbNcsP8lPwW5RUwyrMo3/hNn/2WJpz4JPs1LCTVst+gyiC5hVeS GbGERVst6nYXBe+gUlKX35gs95lIvum1NzHQWzAUgCTnFv7Z2XNKpZLphXog/g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hQrfB0Mz9zC5S for ; Thu, 20 Aug 2026 17:53:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4592a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 20 Aug 2026 17:53:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Mark Johnston From: Colin Percival Subject: git: 43bbea2cc83e - releng/14.5 - proc: Copy the p_reapsubtree field explicitly during fork List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.5 X-Git-Reftype: branch X-Git-Commit: 43bbea2cc83edb9ed6e498d919a03684bca72835 Auto-Submitted: auto-generated Date: Thu, 20 Aug 2026 17:53:54 +0000 Message-Id: <6a873f32.4592a.2623724e@gitrepo.freebsd.org> The branch releng/14.5 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=43bbea2cc83edb9ed6e498d919a03684bca72835 commit 43bbea2cc83edb9ed6e498d919a03684bca72835 Author: Mark Johnston AuthorDate: 2026-07-27 23:03:47 +0000 Commit: Colin Percival CommitDate: 2026-08-20 17:52:55 +0000 proc: Copy the p_reapsubtree field explicitly during fork p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc, which is copied during fork without any synchronization. However, the field is not stable except when the proctree lock is held, and indeed may change if p1's reaper exits or explicitly releases its reaper status. This state change can race with fork() and leave the child with an incorrect p_reapsubtree field. Close the race: explicitly copy the field under the proctree lock during fork. Approved by: re (cperciva) Reported by: syzkaller Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58482 (cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b) (cherry picked from commit fb0af871db6820862a1a0bbfe56a43c0446e40b3) --- sys/kern/kern_fork.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index d8578f01677b..7b566ebffa8c 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -656,6 +656,13 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * if (p2->p_reaper == p1 && p1 != initproc) { p2->p_reapsubtree = p2->p_pid; proc_id_set_cond(PROC_ID_REAP, p2->p_pid); + } else { + /* + * Explicitly copy this field under the proctree lock, as it + * might have changed since the bulk copying of the parent's + * fields. + */ + p2->p_reapsubtree = p1->p_reapsubtree; } sx_xunlock(&proctree_lock);