From nobody Mon Jul 27 23:11:04 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h8DqD4frPz6m2NV for ; Mon, 27 Jul 2026 23:11:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h8DqD1Szsz3L97 for ; Mon, 27 Jul 2026 23:11:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785193864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9/Ju9vT6YQ3FiyGkZmxQt8aXeNb7bKj+OJt3sYjOoQc=; b=Vkweukbt7cOlyqq7hni0MAwwrIHagDwpx3K3NL0uOw7xtxq4RUm/yOL5LvgrtEvG0FpLws qngJgAAOxF9L1xB89B/6ykY5+/j57uqEGNr1rpsy94u49oOPLocuOeRLq56wRWuGW9YB69 xL2D0upmMhFC1egvv3ssq3Afy5hU0fJ4w4avA997WyQFkzKcGFfsiE/pUHUdqsxD1jzBNi DT9nbZJ4B/JPVC98baO1i9aV+ihKRRJ6Uft+PdHl3mbSvPrO2O8I44VwSUPuavZTIbQZNO iSZPeanST2vouOdtqVVGKcPE4h1m8gB9SnEW26EGgELRmfWIYrPwImAMhYdWCQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785193864; a=rsa-sha256; cv=none; b=sa8vXhmtl2MXk2OSgJBFCJy995qKPNIpCRfBQtR3QqgesPPqe0K/yqLQotdRwiM5BlSBoo 4Z1ftqXvY3Vo5ErpL7uOzqJLmVc+urIP43kZm8VyESmLKqbKUeHfm9YBXfDhqsxub/f6gb sLYP8NsVwkGEnyNKSoRxjxIn5s1GtPO8mkcOWpORVuEgauDpS+9m9QJHprXbhL/gcIcs4U EtMsEu4LOaZyHB3MUCMZSpyqjS0SKk+0LHrd1XymJqUDQCEcSVh3g9K/X4Z6eYvtsiqe7c YLWeJ4vOTZ3/sTLGgkAXavB5zUCKPrlLOX/1s+Nu8REGLODX6nY85YT/Brzd9g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785193864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9/Ju9vT6YQ3FiyGkZmxQt8aXeNb7bKj+OJt3sYjOoQc=; b=k6cbGFRE5HbQj0fSgYTt2WemY+q1Wg0JLjJulw0to/b3N26T0ft8C9dUT3h0W4UeswkkA0 u/kjyKhkVnOZQvxSpRQKROh23jMgH5ZPJn4bqkwOj1tZowmyzmvSlRNT5usDUDE9kpAjjT KdvwDdmSbft+s3Z7BD1q7gY2/bC1lt4owSUVnKJbs6lDouBUq2fu1gwaet943D0CPTFzV7 vBVRP59Y6MrLLViNnXo4bM5OxKg7QbBEa4ieXKjdB6R/j/zf5RnEjuZMD5gDMzkC7obOwo 9Yi64WVX/swPUwP/tF6Id8Bbc7r7F/AWJjAYvetWTkvL/sFBnGhH88/UyZDpGw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h8DqD03kdz1Rwy for ; Mon, 27 Jul 2026 23:11:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 31be0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 27 Jul 2026 23:11:04 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 8616b7dc3850 - main - proc: Copy the p_reapsubtree field explicitly during fork List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8616b7dc3850758eb39a5b63f41f56c05403380b Auto-Submitted: auto-generated Date: Mon, 27 Jul 2026 23:11:04 +0000 Message-Id: <6a67e588.31be0.617c5b5f@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8616b7dc3850758eb39a5b63f41f56c05403380b commit 8616b7dc3850758eb39a5b63f41f56c05403380b Author: Mark Johnston AuthorDate: 2026-07-27 23:03:47 +0000 Commit: Mark Johnston CommitDate: 2026-07-27 23:03:47 +0000 proc: Copy the p_reapsubtree field explicitly during fork p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc, which is copied during fork without any synchronization. However, the field is not stable except when the proctree lock is held, and indeed may change if p1's reaper exits or explicitly releases its reaper status. This state change can race with fork() and leave the child with an incorrect p_reapsubtree field. Close the race: explicitly copy the field under the proctree lock during fork. Reported by: syzkaller Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58482 --- sys/kern/kern_fork.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index 60d89c03f865..e3d7b39e687a 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -701,6 +701,13 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * if (p2->p_reaper == p1 && p1 != initproc) { p2->p_reapsubtree = p2->p_pid; proc_id_set_cond(PROC_ID_REAP, p2->p_pid); + } else { + /* + * Explicitly copy this field under the proctree lock, as it + * might have changed since the bulk copying of the parent's + * fields. + */ + p2->p_reapsubtree = p1->p_reapsubtree; } sx_xunlock(&proctree_lock);