From nobody Fri Jun 26 22:20:52 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gn99d3Tg6z6j2hh for ; Fri, 26 Jun 2026 22:20:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gn99c5F9fz3mDB for ; Fri, 26 Jun 2026 22:20:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782512452; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oYjwhaMLetos7Clp/49GvXdw/mvGOq177lHId10PnE0=; b=xg602L9hXsacq3AyqVtmLkwqJ/Nxf0xD/nctHPphBF1Gjre+/8A1qbyzRnc5oACq+U0VH0 7tb3aDwpkCjaoyW6wls8h4UnemslUsY89yC6pb0P3rjX0Iy5QpbHTPdTcrG3iDVreSMgXH EVx8wAiPrF2XNopH7sgYa9gf6fP6j5uSCEoxO02vlNdXxThv9Iy8hP+YZODxGWenCZ06ZQ nGBST0qH8/QJM/hd0QAk8LbMz0+53miTQaEzhFh9FApiw7oxXpbmOU4tLvV5zK/8SUGAP6 tgz3i3tFt5G3AQ6axs6mtcaTrupEa40MVKCDl2FKS0u6VbRmNgnvJw2HdEV3Pg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782512452; a=rsa-sha256; cv=none; b=xf84yJZ0cSl7kEAZre+IQTZ3H+8JDfLCq3T9IsPHz9LYWwrnpGjsaBhAiMD0HT4nsmRIDi x6vub6P+IJARcOE+cRwZrEW0nuH8C8lv7844CVlBVQCl9kv+8E5qv1S/U7XwXZGVg6mKs4 aF79qcKYpo7K+Scetm+SIfBctK5g5dXOOg3BbrIrRG1C12MwF1Qhg8XxgWgJc4LyV2VQy6 oBiAn0iYtt8rvTZqJWB+yPqE2H53vDjlK073f8mfUL7xBxUbNOpKYU8z8ZmIxusP2C0JpG 7YALTKqV4GZTY2GlPXyIb0NvfR9ADwsjbb2C5t1yn7tj1RWv1nHsUaWmeNJnNQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782512452; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oYjwhaMLetos7Clp/49GvXdw/mvGOq177lHId10PnE0=; b=pWlu/14LJBLZQupCTpEZkWiBaPeSoAZtS3sndfvJUno7KwaYc0/9+OiYMeqY45l2L54+G6 kwXUieQ6jA0Jlkk8dXVqY1Nqd8NV6QnWH2+/VtHJynZZKJhzY9ah3MDjH91n0n9lzDty7I WaV1QTTeqSnjIjD+5daFKHHb7k2mNwRx76/Q2eLl+Nmcgbh7yDMGmNaO2ugcqDKVNXHYxL DM+QU/KPVtZVZFnofmXdKawa7QBEeiZkOtGIw3AYFg4uOs2NpaCnIbK6PIy3Z3qCb0+skn sxZGU3RdYZPNhoIODNNDmAAxikItiH7y6wlqGrDpTBZGO/6FdoAL5T0X6uUCpg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gn99c3dZszxK2 for ; Fri, 26 Jun 2026 22:20:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3083b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 26 Jun 2026 22:20:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 60d8df61846f - stable/15 - kern_proc.c: disallow execve around sysctl kern.proc.kstacks List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 60d8df61846fc1f5f7e2a400d2b0237c9f1a6be8 Auto-Submitted: auto-generated Date: Fri, 26 Jun 2026 22:20:52 +0000 Message-Id: <6a3efb44.3083b.2a439f4d@gitrepo.freebsd.org> The branch stable/15 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=60d8df61846fc1f5f7e2a400d2b0237c9f1a6be8 commit 60d8df61846fc1f5f7e2a400d2b0237c9f1a6be8 Author: Konstantin Belousov AuthorDate: 2026-06-15 17:57:47 +0000 Commit: Konstantin Belousov CommitDate: 2026-06-26 22:16:07 +0000 kern_proc.c: disallow execve around sysctl kern.proc.kstacks (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4) --- sys/kern/kern_proc.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index 056176399062..e2a71466a273 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -43,6 +43,7 @@ #include #include #include +#include #include #include #include @@ -2861,7 +2862,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) struct kinfo_kstack *kkstp; int error, i, *name, numthreads; lwpid_t *lwpidarray; - struct thread *td; + struct thread *td, *ctd; struct stack *st; struct sbuf sb; struct proc *p; @@ -2872,7 +2873,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; - error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p); + ctd = curthread; + error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); @@ -2881,6 +2883,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) lwpidarray = NULL; PROC_LOCK(p); + execve_block_wait(ctd, p); + error = p_candebug(ctd, p); + if (error != 0) { + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); + return (error); + } do { if (lwpidarray != NULL) { free(lwpidarray, M_TEMP); @@ -2893,15 +2903,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) PROC_LOCK(p); } while (numthreads < p->p_numthreads); - /* - * XXXRW: During the below loop, execve(2) and countless other sorts - * of changes could have taken place. Should we check to see if the - * vmspace has been replaced, or the like, in order to prevent - * giving a snapshot that spans, say, execve(2), with some threads - * before and some after? Among other things, the credentials could - * have changed, in which case the right to extract debug info might - * no longer be assured. - */ i = 0; FOREACH_THREAD_IN_PROC(p, td) { KASSERT(i < numthreads, @@ -2934,7 +2935,10 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) if (error) break; } - PRELE(p); + PROC_LOCK(p); + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); if (lwpidarray != NULL) free(lwpidarray, M_TEMP); stack_destroy(st);