git: 197f367cdda7 - stable/14 - kern_proc.c: disallow execve around sysctl kern.proc.kstacks

The branch stable/14 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=197f367cdda7919578d15b1562225d6db462c5ad

commit 197f367cdda7919578d15b1562225d6db462c5ad
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-06-15 17:57:47 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-06-28 00:29:00 +0000

    kern_proc.c: disallow execve around sysctl kern.proc.kstacks
    
    (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4)
---
 sys/kern/kern_proc.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index bac8b5c9d1ad..91c9d4473d76 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -45,6 +45,7 @@
 #include <sys/eventhandler.h>
 #include <sys/exec.h>
 #include <sys/fcntl.h>
+#include <sys/imgact.h>
 #include <sys/ipc.h>
 #include <sys/jail.h>
 #include <sys/kernel.h>
@@ -2863,7 +2864,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
 	struct kinfo_kstack *kkstp;
 	int error, i, *name, numthreads;
 	lwpid_t *lwpidarray;
-	struct thread *td;
+	struct thread *td, *ctd;
 	struct stack *st;
 	struct sbuf sb;
 	struct proc *p;
@@ -2874,7 +2875,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
 		return (EINVAL);
 
 	name = (int *)arg1;
-	error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p);
+	ctd = curthread;
+	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
 	if (error != 0)
 		return (error);
 
@@ -2883,6 +2885,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
 
 	lwpidarray = NULL;
 	PROC_LOCK(p);
+	execve_block_wait(ctd, p);
+	error = p_candebug(ctd, p);
+	if (error != 0) {
+		execve_unblock(ctd, p);
+		_PRELE(p);
+		PROC_UNLOCK(p);
+		return (error);
+	}
 	do {
 		if (lwpidarray != NULL) {
 			free(lwpidarray, M_TEMP);
@@ -2895,15 +2905,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
 		PROC_LOCK(p);
 	} while (numthreads < p->p_numthreads);
 
-	/*
-	 * XXXRW: During the below loop, execve(2) and countless other sorts
-	 * of changes could have taken place.  Should we check to see if the
-	 * vmspace has been replaced, or the like, in order to prevent
-	 * giving a snapshot that spans, say, execve(2), with some threads
-	 * before and some after?  Among other things, the credentials could
-	 * have changed, in which case the right to extract debug info might
-	 * no longer be assured.
-	 */
 	i = 0;
 	FOREACH_THREAD_IN_PROC(p, td) {
 		KASSERT(i < numthreads,
@@ -2938,7 +2939,10 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
 		if (error)
 			break;
 	}
-	PRELE(p);
+	PROC_LOCK(p);
+	execve_unblock(ctd, p);
+	_PRELE(p);
+	PROC_UNLOCK(p);
 	if (lwpidarray != NULL)
 		free(lwpidarray, M_TEMP);
 	stack_destroy(st);