git: 026d962ef14d - main - proc: Fix proc_init / proc_dtor ordering issues

The branch main has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=026d962ef14dafe19fa73361bea6dcc95f141dfa

commit 026d962ef14dafe19fa73361bea6dcc95f141dfa
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2025-12-14 13:16:22 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2025-12-14 13:16:37 +0000

    proc: Fix proc_init / proc_dtor ordering issues
    
    * Move the initialization of p_ktr into proc_init() and make the check
      in proc_dtor() unconditional.  Prior to this, it was possible to fail
      and invoke proc_dtor() after the first thread had been created (which
      was the condition for checking p_ktr in proc_dtor()) but before p_ktr
      had been initialized.
    
    * Move the p_klist initialization in fork1() past the last possible
      failure point so we don't have to free it on failure.  We didn't,
      which meant we were leaking a knlist every time we failed to fork
      due to hitting the resource limit.
    
    PR:             291470
    MFC after:      1 week
    Reviewed by:    kib
    Differential Revision:  https://reviews.freebsd.org/D54215
---
 sys/kern/kern_fork.c | 4 ++--
 sys/kern/kern_proc.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index 8b237b6dbd17..961d72c46d2c 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -1065,8 +1065,6 @@ fork1(struct thread *td, struct fork_req *fr)
 #ifdef MAC
 	mac_proc_init(newproc);
 #endif
-	newproc->p_klist = knlist_alloc(&newproc->p_mtx);
-	STAILQ_INIT(&newproc->p_ktr);
 
 	/*
 	 * Increment the count of procs running with this uid. Don't allow
@@ -1079,6 +1077,8 @@ fork1(struct thread *td, struct fork_req *fr)
 		chgproccnt(cred->cr_ruidinfo, 1, 0);
 	}
 
+	newproc->p_klist = knlist_alloc(&newproc->p_mtx);
+
 	do_fork(td, fr, newproc, td2, vm2, fp_procdesc);
 	error = 0;
 	goto cleanup;
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index 6e56664d12ce..8f86ce349e30 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -241,11 +241,9 @@ proc_dtor(void *mem, int size, void *arg)
 	p = (struct proc *)mem;
 	td = FIRST_THREAD_IN_PROC(p);
 	if (td != NULL) {
-#ifdef INVARIANTS
 		KASSERT((p->p_numthreads == 1),
-		    ("bad number of threads in exiting process"));
-		KASSERT(STAILQ_EMPTY(&p->p_ktr), ("proc_dtor: non-empty p_ktr"));
-#endif
+		    ("too many threads in exiting process"));
+
 		/* Free all OSD associated to this thread. */
 		osd_thread_exit(td);
 		ast_kclear(td);
@@ -253,6 +251,7 @@ proc_dtor(void *mem, int size, void *arg)
 		/* Make sure all thread destructors are executed */
 		EVENTHANDLER_DIRECT_INVOKE(thread_dtor, td);
 	}
+	KASSERT(STAILQ_EMPTY(&p->p_ktr), ("proc_dtor: non-empty p_ktr"));
 	EVENTHANDLER_DIRECT_INVOKE(process_dtor, p);
 #ifdef KDTRACE_HOOKS
 	kdtrace_proc_dtor(p);
@@ -281,6 +280,7 @@ proc_init(void *mem, int size, int flags)
 	p->p_stats = pstats_alloc();
 	p->p_pgrp = NULL;
 	TAILQ_INIT(&p->p_kqtim_stop);
+	STAILQ_INIT(&p->p_ktr);
 	return (0);
 }