From nobody Sun Jun 28 00:30:08 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gnr0J6Zqgz6jDRs for ; Sun, 28 Jun 2026 00:30:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gnr0J3xSKz3dK1 for ; Sun, 28 Jun 2026 00:30:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782606608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bAmxPPNHT4Oo7neaUYmQRRxD31cFQ8UMfhqMyIqigkk=; b=vtnnWOns5JGgypHRPYKXm2qkBHCsN1HyJH3Tr/rp7Q7MUqUby4zRaGHpSZSW8Y7uUDQi42 OYVyrbTfwlXf3raT3GGh3KXJL3j8TBVvM4Wdi3ouIbrBxEHujL/xm9A7vLdzbWcsBFKMF6 KGf1y+9YC2Yg//FrIHBcp84mzfNUiYKsEgtBjO5XPEnNffw5pgTJGREjdEphzb9UMuNYd9 40HRkuLqWylxkZmc4lVTsr6P5h6VZppr07/TDMzhwwA778z41i3c58w6TJuf7u7ylUGrWv b5bmOVBstX61foabOUDbP4RoZVwZeohFNWW+stKgCAXPsUxuBI4WpeXErMCB7w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782606608; a=rsa-sha256; cv=none; b=P2XTx+/BqOm+uw+gidoeAFJk9bTue7d1ZRkDYIs9GrihDfkUiUVLxmaMgexlwYpXv6dPof BSCzlpSyzkcll72vZw1oXZLi8spcJDpO50B0jm3S0QdXff/kdKJROrdD3rCPUjxcJjvETQ osALyGr57jCO2dK/4QwBKVwNlRbwhpNEl0LxRS0P7dCJEvvupjp8TE6B62Yq2R8wJfeCE7 wtuMwTdPd+ARbvNACD9KV6FU0y8QId2IlcAmbXNx/U83xjigpqQeUMAP8RjmBo4Q3UzB3Z GZW63Ykn+dZzvOK5r3ctiway9xJEgLFf3QL/VQRymvpvegz/Gl9FiWWioBPdbA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782606608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bAmxPPNHT4Oo7neaUYmQRRxD31cFQ8UMfhqMyIqigkk=; b=IrcBP8WDPj9DJW7Lq12NkZNO3gDP1t+PYP22/cyGyMWWNe1pbWLHGJVAFM864JBuo+iDlC dP+oHGNW+d0PaMuE+A7ny7sM/SCNe8GCnse5Crjn2lpo9U2OyUvAnkj83AzeO/N5GeOgfP snEQcuyqh4beDTfDxLAZ/2Zy5QzaD8ooJCbTpkTZaYrU2fm85x0cEz0R06iD3K4kDEU5Ys GGNDkJ8xRyffz5s1q3iCqUzl5kePHL+s/BPbdotPEI7juXjqhClDkZBtMOJmh7lWzCn5DR bEXLlyCbUGhpRnGu21UrcIj4u7S9VpSzpU2bQO8O/RQE7yzkG5dDh9bNAk6NcA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gnr0J2qKnzn3M for ; Sun, 28 Jun 2026 00:30:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e2b0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 28 Jun 2026 00:30:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 197f367cdda7 - stable/14 - kern_proc.c: disallow execve around sysctl kern.proc.kstacks List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 197f367cdda7919578d15b1562225d6db462c5ad Auto-Submitted: auto-generated Date: Sun, 28 Jun 2026 00:30:08 +0000 Message-Id: <6a406b10.3e2b0.3bbbbc49@gitrepo.freebsd.org> The branch stable/14 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=197f367cdda7919578d15b1562225d6db462c5ad commit 197f367cdda7919578d15b1562225d6db462c5ad Author: Konstantin Belousov AuthorDate: 2026-06-15 17:57:47 +0000 Commit: Konstantin Belousov CommitDate: 2026-06-28 00:29:00 +0000 kern_proc.c: disallow execve around sysctl kern.proc.kstacks (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4) --- sys/kern/kern_proc.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index bac8b5c9d1ad..91c9d4473d76 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -2863,7 +2864,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) struct kinfo_kstack *kkstp; int error, i, *name, numthreads; lwpid_t *lwpidarray; - struct thread *td; + struct thread *td, *ctd; struct stack *st; struct sbuf sb; struct proc *p; @@ -2874,7 +2875,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; - error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p); + ctd = curthread; + error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); @@ -2883,6 +2885,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) lwpidarray = NULL; PROC_LOCK(p); + execve_block_wait(ctd, p); + error = p_candebug(ctd, p); + if (error != 0) { + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); + return (error); + } do { if (lwpidarray != NULL) { free(lwpidarray, M_TEMP); @@ -2895,15 +2905,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) PROC_LOCK(p); } while (numthreads < p->p_numthreads); - /* - * XXXRW: During the below loop, execve(2) and countless other sorts - * of changes could have taken place. Should we check to see if the - * vmspace has been replaced, or the like, in order to prevent - * giving a snapshot that spans, say, execve(2), with some threads - * before and some after? Among other things, the credentials could - * have changed, in which case the right to extract debug info might - * no longer be assured. - */ i = 0; FOREACH_THREAD_IN_PROC(p, td) { KASSERT(i < numthreads, @@ -2938,7 +2939,10 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) if (error) break; } - PRELE(p); + PROC_LOCK(p); + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); if (lwpidarray != NULL) free(lwpidarray, M_TEMP); stack_destroy(st);