git: 09984871d8ca - main - procdesc: postpone freeing the zombie' pid until procdesc is freed

From: Konstantin Belousov <kib_at_FreeBSD.org>
Date: Sun, 25 Jan 2026 15:56:57 UTC
The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=09984871d8caff9263b955a94bb9fb5354af1b4c

commit 09984871d8caff9263b955a94bb9fb5354af1b4c
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-01-15 05:28:31 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-01-25 15:53:54 +0000

    procdesc: postpone freeing the zombie' pid until procdesc is freed
    
    Requested by:   asomers
    Reviewed by:    asomers, markj
    Tested by:      pho
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D54592
---
 sys/kern/kern_exit.c    | 4 ++--
 sys/kern/sys_procdesc.c | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index 53225bcfd425..beb29e890bd7 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -979,10 +979,10 @@ proc_reap(struct thread *td, struct proc *p, int *status, int options)
 	leavepgrp(p);
 	if (p->p_procdesc != NULL)
 		procdesc_reap(p);
+	else
+		proc_id_clear(PROC_ID_PID, p->p_pid);
 	sx_xunlock(&proctree_lock);
 
-	proc_id_clear(PROC_ID_PID, p->p_pid);
-
 	PROC_LOCK(p);
 	knlist_detach(p->p_klist);
 	p->p_klist = NULL;
diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c
index c5db21544b0f..4f5b08003735 100644
--- a/sys/kern/sys_procdesc.c
+++ b/sys/kern/sys_procdesc.c
@@ -270,6 +270,9 @@ procdesc_free(struct procdesc *pd)
 		KASSERT((pd->pd_flags & PDF_CLOSED),
 		    ("procdesc_free: !PDF_CLOSED"));
 
+		if (pd->pd_pid != -1)
+			proc_id_clear(PROC_ID_PID, pd->pd_pid);
+
 		knlist_destroy(&pd->pd_selinfo.si_note);
 		PROCDESC_LOCK_DESTROY(pd);
 		free(pd, M_PROCDESC);
@@ -389,6 +392,7 @@ procdesc_close(struct file *fp, struct thread *td)
 			 */
 			pd->pd_proc = NULL;
 			p->p_procdesc = NULL;
+			pd->pd_pid = -1;
 			procdesc_free(pd);
 
 			/*