Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 28 Feb 2026 01:33:17 +0000
From:      Konstantin Belousov <kib@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: cf64824a3e95 - stable/15 - reap_kill_subtree_once(): reap_kill_proc_work() might drop proctree_lock
Message-ID:  <69a245dd.1bea1.c3430f5@gitrepo.freebsd.org>

index | next in thread | raw e-mail

The branch stable/15 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=cf64824a3e95777834233064dfbf6ed9f8a1c663

commit cf64824a3e95777834233064dfbf6ed9f8a1c663
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-02-16 15:20:02 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-02-28 01:32:24 +0000

    reap_kill_subtree_once(): reap_kill_proc_work() might drop proctree_lock
    
    (cherry picked from commit 0e67c3f675eab3a9c00b76e3886ace7700ef1bd4)
---
 sys/kern/kern_procctl.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sys/kern/kern_procctl.c b/sys/kern/kern_procctl.c
index 04c47d086677..30ab37d56877 100644
--- a/sys/kern/kern_procctl.c
+++ b/sys/kern/kern_procctl.c
@@ -280,7 +280,7 @@ reap_kill_proc_locked(struct reap_kill_proc_work *w)
 }
 
 static void
-reap_kill_proc(struct reap_kill_proc_work *w)
+reap_kill_proc(struct reap_kill_proc_work *w, bool *proctree_dropped)
 {
 	struct pgrp *pgrp;
 	int xlocked;
@@ -311,6 +311,7 @@ reap_kill_proc(struct reap_kill_proc_work *w)
 		/* This is safe because pgrp zone is nofree. */
 		sx_xlock(&pgrp->pg_killsx);
 		sx_xunlock(&pgrp->pg_killsx);
+		*proctree_dropped = true;
 		if (xlocked)
 			sx_xlock(&proctree_lock);
 		else
@@ -392,7 +393,7 @@ reap_kill_subtree_once(struct thread *td, struct proc *p, struct proc *reaper,
 	struct reap_kill_tracker_head tracker;
 	struct reap_kill_tracker *t;
 	struct proc *p2;
-	bool res;
+	bool proctree_dropped, res;
 
 	res = false;
 	TAILQ_INIT(&tracker);
@@ -400,6 +401,7 @@ reap_kill_subtree_once(struct thread *td, struct proc *p, struct proc *reaper,
 	while ((t = TAILQ_FIRST(&tracker)) != NULL) {
 		TAILQ_REMOVE(&tracker, t, link);
 
+again:
 		/*
 		 * Since reap_kill_proc() drops proctree_lock sx, it
 		 * is possible that the tracked reaper is no longer.
@@ -435,6 +437,7 @@ reap_kill_subtree_once(struct thread *td, struct proc *p, struct proc *reaper,
 			    (P2_REAPKILLED | P2_WEXIT)) != 0)
 				continue;
 
+			proctree_dropped = false;
 			PROC_LOCK(p2);
 			if ((p2->p_flag2 & P2_WEXIT) == 0) {
 				_PHOLD(p2);
@@ -446,11 +449,13 @@ reap_kill_subtree_once(struct thread *td, struct proc *p, struct proc *reaper,
 				p2->p_flag2 |= P2_REAPKILLED;
 
 				w->target = p2;
-				reap_kill_proc(w);
+				reap_kill_proc(w, &proctree_dropped);
 				_PRELE(p2);
 			}
 			PROC_UNLOCK(p2);
 			res = true;
+			if (proctree_dropped)
+				goto again;
 		}
 		reap_kill_sched_free(t);
 	}


home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69a245dd.1bea1.c3430f5>