From nobody Mon Aug 17 12:10:16 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hNs944Tqyz6pCJV for ; Mon, 17 Aug 2026 12:10:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hNs943Chdz3F79 for ; Mon, 17 Aug 2026 12:10:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786968616; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=soeUb3/tPLXHxPECj4u3byeEVGLHH5leKhq4C/meIEY=; b=SlXxx0XaSlozYf3l60IJ00oj3rrLhnDhMnSkvFIj1D9FWYMNfBOWsY5SbFdkZJDSjf1zWY 8p3DGFOVJXnIm5HGVPYaW3/iYR00mgUd2rwVB5vrns6xqWoFUAXU76uI83/eae2edQUGee /q8oacrxF7gvatjzSGlm/IHeZ2+J8gok+sz6UPZ9xjyaAI26i8fclN86FUQ6hHosh1LGpi KjEhrL6Dstdb+4qPffqMTx/Dl93k//ql3RkamVGMCyMXFNc4SZbSdiRR/yKgdsRPv9BSV6 3+t3L7/Y81dZg3Ff1hVbSt+ng/riNyzEoRq8ln95Crsq5JD4K4/Le+4DBmBHPg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786968616; a=rsa-sha256; cv=none; b=XN4otjew5jOb38jrBDcx40yCsYsZC+I2CG0qXdy7KGGjNQPxg0dXwps9tezFblr2qjwoUf ay66LbctIGYYypOA7Y1yQIM414+hPPuBvp+6FxxKkDM0g2KimRI1Ri42nQnbINdVhQ+TCj chAYwT3bTuF60ObAI73OeSdlpiElhz9C2XUcHxHnaJFrQmsI8W2ro6T5f9wOetK9k5hvRQ CkhvIBneH+x19e6yYVh/+seHRAwxLGOrWATTDmOXEiU0+V98e60+xFYYlMY34uGoVGDYBC HSXp6fh7qKdbWD5QG0/Zjph4gOG881CH/z1X3J623BGODP6uh5g7J5h0ekM2cA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786968616; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=soeUb3/tPLXHxPECj4u3byeEVGLHH5leKhq4C/meIEY=; b=xMc83JvFn2UZalK43ICBEeHyveR8ZFp8ECr3nGHfOvuk1pX4BIem8BieviqYmzsn+4ZeHo zljopPEb3zn/8NCB7zmd+D4+DPhDB4VnwDcUthtqczR0WNNZ94eIcFXrfs6t4Aa4Vb/RId DL0waSOTLoqAfnA4Cfx97j2JHEgn9dHoBGTn9QmE9Vs8PvDkpOIcyC+nwHkmf61j3qR1uA zXAMdhgv8GjEtQUfqgi2lK4LQoKlmmNeiCk+DGG7WX1ZQQdUndrhIw/e1wM3G3QQVsQ1kL Uvc/fhK22uAMVh5mnWbs+mZ8eCC0dm1eft+7Mxe7aLJerE2IQnw5YlfGLi4+pw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hNs9425rCz1CCH for ; Mon, 17 Aug 2026 12:10:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ca30 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 17 Aug 2026 12:10:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 7e6d8a8b8fb6 - stable/15 - proc: Copy the p_reapsubtree field explicitly during fork List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 7e6d8a8b8fb66597f30067b6eb56b1c0a6ac2d50 Auto-Submitted: auto-generated Date: Mon, 17 Aug 2026 12:10:16 +0000 Message-Id: <6a82fa28.3ca30.355b0eb2@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7e6d8a8b8fb66597f30067b6eb56b1c0a6ac2d50 commit 7e6d8a8b8fb66597f30067b6eb56b1c0a6ac2d50 Author: Mark Johnston AuthorDate: 2026-07-27 23:03:47 +0000 Commit: Mark Johnston CommitDate: 2026-08-17 12:07:41 +0000 proc: Copy the p_reapsubtree field explicitly during fork p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc, which is copied during fork without any synchronization. However, the field is not stable except when the proctree lock is held, and indeed may change if p1's reaper exits or explicitly releases its reaper status. This state change can race with fork() and leave the child with an incorrect p_reapsubtree field. Close the race: explicitly copy the field under the proctree lock during fork. Reported by: syzkaller Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58482 (cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b) --- sys/kern/kern_fork.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index 3c8193542eb2..9bdaca27f4e1 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -709,6 +709,13 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * if (p2->p_reaper == p1 && p1 != initproc) { p2->p_reapsubtree = p2->p_pid; proc_id_set_cond(PROC_ID_REAP, p2->p_pid); + } else { + /* + * Explicitly copy this field under the proctree lock, as it + * might have changed since the bulk copying of the parent's + * fields. + */ + p2->p_reapsubtree = p1->p_reapsubtree; } sx_xunlock(&proctree_lock);