Date: Sun, 28 Jun 2026 00:30:11 +0000 From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 190d6677b11a - stable/14 - kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage Message-ID: <6a406b13.3f11e.77e29ac5@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/14 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=190d6677b11a1deed6bd0ef14fd4f990eea20f5b commit 190d6677b11a1deed6bd0ef14fd4f990eea20f5b Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-06-16 04:34:16 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-06-28 00:29:01 +0000 kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) --- sys/kern/kern_resource.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c index 9729bf987aa6..80f3588f2614 100644 --- a/sys/kern/kern_resource.c +++ b/sys/kern/kern_resource.c @@ -48,6 +48,7 @@ #include <sys/mutex.h> #include <sys/priv.h> #include <sys/proc.h> +#include <sys/ptrace.h> #include <sys/refcount.h> #include <sys/racct.h> #include <sys/resourcevar.h> @@ -810,11 +811,11 @@ sys_getrlimit(struct thread *td, struct getrlimit_args *uap) } static int -getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) +getrlimitusage_one(struct proc *p, struct vmspace *vm, u_int which, int flags, + rlim_t *res) { struct thread *td; struct uidinfo *ui; - struct vmspace *vm; uid_t uid; int error; @@ -825,7 +826,6 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) PROC_UNLOCK(p); ui = uifind(uid); - vm = vmspace_acquire_ref(p); switch (which) { case RLIMIT_CPU: @@ -903,7 +903,6 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) break; } - vmspace_free(vm); uifree(ui); return (error); } @@ -911,12 +910,15 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) int sys_getrlimitusage(struct thread *td, struct getrlimitusage_args *uap) { + struct proc *p; rlim_t res; int error; if ((uap->flags & ~(GETRLIMITUSAGE_EUID)) != 0) return (EINVAL); - error = getrlimitusage_one(curproc, uap->which, uap->flags, &res); + p = curproc; + error = getrlimitusage_one(p, p->p_vmspace, uap->which, uap->flags, + &res); if (error == 0) error = copyout(&res, uap->res, sizeof(res)); return (error); @@ -1750,6 +1752,8 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) { rlim_t resval[RLIM_NLIMITS]; struct proc *p; + struct thread *td; + struct vmspace *vm; size_t len; int error, *name, i; @@ -1759,15 +1763,20 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) if (req->newptr != NULL) return (EINVAL); - error = pget((pid_t)name[0], PGET_WANTREAD, &p); + td = curthread; + error = pget((pid_t)name[0], PGET_HOLD | PGET_NOTWEXIT, &p); if (error != 0) return (error); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); + if (error != 0) + goto out; if ((u_int)arg2 == 1) { len = sizeof(resval); memset(resval, 0, sizeof(resval)); for (i = 0; i < RLIM_NLIMITS; i++) { - error = getrlimitusage_one(p, (unsigned)i, 0, + error = getrlimitusage_one(p, vm, (unsigned)i, 0, &resval[i]); if (error == ENXIO) { resval[i] = -1; @@ -1778,7 +1787,7 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) } } else { len = sizeof(resval[0]); - error = getrlimitusage_one(p, (unsigned)name[1], 0, + error = getrlimitusage_one(p, vm, (unsigned)name[1], 0, &resval[0]); if (error == ENXIO) { resval[0] = -1; @@ -1787,6 +1796,8 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) } if (error == 0) error = SYSCTL_OUT(req, resval, len); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); +out: PRELE(p); return (error); }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a406b13.3f11e.77e29ac5>