From nobody Fri Jun 26 22:20:55 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gn99h2TG1z6j2Wl for ; Fri, 26 Jun 2026 22:20:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gn99g6fvZz3mS2 for ; Fri, 26 Jun 2026 22:20:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782512455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rsjHEURsZPLHRK9j2nMJc5sHaCHTSttSDoefIQSghIY=; b=JDF8+kzA4fj2q+U6kTBVanI+jgGQB50LIXcJgUZXM8NOCC2lnjyxc4WwU/r3SRtWJT6j2F 7HOw2JF5/o6GcssFIFWVFyjf309LPBj8tngowMHLU8OYYSvQVjCZk7pvYdYdW+Il7PiUlo tLdRcgN7+8Hyc9D2+/GOUUScpgEPTkG7lzJd4EQRZDmxtgQPYLn4LBsrk2OSfd0lQKmxnj XzDlY++LrmVCtDT26knNg/gsRRRpX3eWOnrKTCgsV15xO/anoWuYjE0ekm8olIzMrQYbUY K/Cfs290EvYSrUvCtdVdq+z6I0x4ofUlJvaPl0pXzuSErKOkfZjse4bnQq4oVQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782512455; a=rsa-sha256; cv=none; b=fp8iHuFYBb94nJ1i1jkD+rCJwVZdSGnHEv00KuD2QLr8nPFv6WCrpxuDyGYkpZUdxuyati rfX52ILGKoclKwvKEJgyxREw/lfnt8PfnBJpvKuUEjUpVTEzquivhDeN74u8Em6FB44f6m 3A1X6o53sWbO8hDTokcv35/CvLztTsTOq3M4Uif7qWuGRz94dwLhNHsWWAd35NG9KS551p dd48WeMy6W3Ts0M4M93ibro4KkdJ+2TamldsWND2lTerIsW9CPCgn/0YssdJKiZj7fT5Yr sh+5BGjMvrW/b0XZTNIOUE0afrEsKbFz+62qxmMKsT/mdieHaZKBsQ9tzh2cbQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782512455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rsjHEURsZPLHRK9j2nMJc5sHaCHTSttSDoefIQSghIY=; b=uy9Fb4tY2JZwT/iPk297GmEHXHQ5ZedWq/DBUUG4OHVvuLsmy+f2rScltIq3QJC7BoF5FS cDaTf7RnOPWuzdTZwQ1AILdCRx2NzOEmffX9Go54hCN3rIyuquarii+cDDzuDyj/H1hRIF czoanuJD/UxRWUjEL+QhD/v4k6ul1bv8knMjO3lllDPfgy/vAZPrf3c8HSBFaDKqH6ibBF F95aKA9Tdjb8uUFlFveC2T7WhR2ygtBU9319Q1rdTSTbqnO0LsV29LUCHcsjrogrQb5LN7 N5HF9+9DauLzns6VcSmF5i7v1vqIjTKwna+MEgHf7L6zx1RW0mTbu25MX37QNg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gn99g5YMyzxTv for ; Fri, 26 Jun 2026 22:20:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 27830 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 26 Jun 2026 22:20:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 035f66ff2924 - stable/15 - kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 035f66ff2924808f534df9065388aabf66e77266 Auto-Submitted: auto-generated Date: Fri, 26 Jun 2026 22:20:55 +0000 Message-Id: <6a3efb47.27830.543f9403@gitrepo.freebsd.org> The branch stable/15 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=035f66ff2924808f534df9065388aabf66e77266 commit 035f66ff2924808f534df9065388aabf66e77266 Author: Konstantin Belousov AuthorDate: 2026-06-16 04:34:16 +0000 Commit: Konstantin Belousov CommitDate: 2026-06-26 22:16:09 +0000 kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) --- sys/kern/kern_resource.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c index 5850d2708a11..e45d3ff82421 100644 --- a/sys/kern/kern_resource.c +++ b/sys/kern/kern_resource.c @@ -46,6 +46,7 @@ #include #include #include +#include #include #include #include @@ -823,11 +824,11 @@ sys_getrlimit(struct thread *td, struct getrlimit_args *uap) } static int -getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) +getrlimitusage_one(struct proc *p, struct vmspace *vm, u_int which, int flags, + rlim_t *res) { struct thread *td; struct uidinfo *ui; - struct vmspace *vm; uid_t uid; int error; @@ -838,7 +839,6 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) PROC_UNLOCK(p); ui = uifind(uid); - vm = vmspace_acquire_ref(p); switch (which) { case RLIMIT_CPU: @@ -916,7 +916,6 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) break; } - vmspace_free(vm); uifree(ui); return (error); } @@ -924,12 +923,15 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) int sys_getrlimitusage(struct thread *td, struct getrlimitusage_args *uap) { + struct proc *p; rlim_t res; int error; if ((uap->flags & ~(GETRLIMITUSAGE_EUID)) != 0) return (EINVAL); - error = getrlimitusage_one(curproc, uap->which, uap->flags, &res); + p = curproc; + error = getrlimitusage_one(p, p->p_vmspace, uap->which, uap->flags, + &res); if (error == 0) error = copyout(&res, uap->res, sizeof(res)); return (error); @@ -1784,6 +1786,8 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) { rlim_t resval[RLIM_NLIMITS]; struct proc *p; + struct thread *td; + struct vmspace *vm; size_t len; int error, *name, i; @@ -1793,15 +1797,20 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) if (req->newptr != NULL) return (EINVAL); - error = pget((pid_t)name[0], PGET_WANTREAD, &p); + td = curthread; + error = pget((pid_t)name[0], PGET_HOLD | PGET_NOTWEXIT, &p); if (error != 0) return (error); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); + if (error != 0) + goto out; if ((u_int)arg2 == 1) { len = sizeof(resval); memset(resval, 0, sizeof(resval)); for (i = 0; i < RLIM_NLIMITS; i++) { - error = getrlimitusage_one(p, (unsigned)i, 0, + error = getrlimitusage_one(p, vm, (unsigned)i, 0, &resval[i]); if (error == ENXIO) { resval[i] = -1; @@ -1812,7 +1821,7 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) } } else { len = sizeof(resval[0]); - error = getrlimitusage_one(p, (unsigned)name[1], 0, + error = getrlimitusage_one(p, vm, (unsigned)name[1], 0, &resval[0]); if (error == ENXIO) { resval[0] = -1; @@ -1821,6 +1830,8 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) } if (error == 0) error = SYSCTL_OUT(req, resval, len); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); +out: PRELE(p); return (error); }