From nobody Sun Jun 28 00:30:11 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gnr0N1mhzz6jDTM for ; Sun, 28 Jun 2026 00:30:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gnr0M654yz3dKL for ; Sun, 28 Jun 2026 00:30:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782606611; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1l308AY5ssqhlqfWEn6Z5Q9z/HP3lH1ONis9+x2wQEk=; b=CsO3S+9oZ1dxGrccYIaTWALP9/ntxhbGdwe8vxeNPtt1rYT0hVkIlARs8BnWS9Dnr7UFxI heiQuncHlH76CL9jYiBc7VGT79iDM5itscGiwvy8YuTMyPeFzMdlf7mvSlGmdyjJ5hW99h vjNv5CA/sT4Eum3PPqNTddM7xPQawYKpcwWnvUagVMnHv8VBXpeq+FdtR+aYn4sYIbIsVb w2LVijBrsB1JcAl0dJz8Y47fiT/xyHTTEi2J10yJL6hqFsUUaS9xiBTgOQWn4gafx1Poih jl+Vd8gHHlnLDz7+65ANFq0QrdXznj/5StSLklNvfQb7UmQsb/LPxdxGadvZiQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782606611; a=rsa-sha256; cv=none; b=JaHuj1C+qVKGfbRckoaiCbwB0Zuk3C29RrLeddANGFykHNpL9XjKCo3Tl+FsYit1AWm4S/ Ws1E4uxpIWxArijqP6ElkoYTzW4VKuhLC/HbsQV/+bZYqyV1IsGy9eXC5FKcXHMN5kZRXK w/e0vFCnUR21dns/MZIdaTlffeiVJl3/7zti3YcE2TrRfS3jsq+lYwh8xFGEBs9QnLiAsS sWYlSSmF0Pzize4IKzvUBZZmQFRKs1wuHtKXRu1RhoWz8grje3LcFc6S6eaxxXH9BS7yQF JcvUBfa55rxsa9Z6fNYL2N2YSnRIMpGE+3RCYE5ljVTD3nXZhiUcDGK0uoMu2Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782606611; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1l308AY5ssqhlqfWEn6Z5Q9z/HP3lH1ONis9+x2wQEk=; b=nYikT/efexVmizRRDHc81K4r8A2h/Hw/1/ZF8wH+Zd2pcVUuCipiCKzLJIvtVLqW7wboMQ 3DioaeKSZElZUQlNvBZueKfR2G1yyYXCZvEgJjEZayEvwj4oUgYQ9uHyPw3RcRiXg3s9EC +uuFgKNkznMfMVCclCO+TOKh0jwIW+8T/LvXGEs4OPnMyiHPaHRQtbl8UtCT7KY50HrfgF rZ3QISDInOGSUabOgmKdwS/jCzXQd54wIgXXBIuZNrUkN3nzB2oJHTCUlo21V3prd/s2HC r6/jihwmI3pD+Bg46/LldTWexGrKrLmVChbck0xIZ21uQWtgRx00cHF8SYkdCA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gnr0M44QFzn3P for ; Sun, 28 Jun 2026 00:30:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f11e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 28 Jun 2026 00:30:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 190d6677b11a - stable/14 - kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 190d6677b11a1deed6bd0ef14fd4f990eea20f5b Auto-Submitted: auto-generated Date: Sun, 28 Jun 2026 00:30:11 +0000 Message-Id: <6a406b13.3f11e.77e29ac5@gitrepo.freebsd.org> The branch stable/14 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=190d6677b11a1deed6bd0ef14fd4f990eea20f5b commit 190d6677b11a1deed6bd0ef14fd4f990eea20f5b Author: Konstantin Belousov AuthorDate: 2026-06-16 04:34:16 +0000 Commit: Konstantin Belousov CommitDate: 2026-06-28 00:29:01 +0000 kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) --- sys/kern/kern_resource.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c index 9729bf987aa6..80f3588f2614 100644 --- a/sys/kern/kern_resource.c +++ b/sys/kern/kern_resource.c @@ -48,6 +48,7 @@ #include #include #include +#include #include #include #include @@ -810,11 +811,11 @@ sys_getrlimit(struct thread *td, struct getrlimit_args *uap) } static int -getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) +getrlimitusage_one(struct proc *p, struct vmspace *vm, u_int which, int flags, + rlim_t *res) { struct thread *td; struct uidinfo *ui; - struct vmspace *vm; uid_t uid; int error; @@ -825,7 +826,6 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) PROC_UNLOCK(p); ui = uifind(uid); - vm = vmspace_acquire_ref(p); switch (which) { case RLIMIT_CPU: @@ -903,7 +903,6 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) break; } - vmspace_free(vm); uifree(ui); return (error); } @@ -911,12 +910,15 @@ getrlimitusage_one(struct proc *p, u_int which, int flags, rlim_t *res) int sys_getrlimitusage(struct thread *td, struct getrlimitusage_args *uap) { + struct proc *p; rlim_t res; int error; if ((uap->flags & ~(GETRLIMITUSAGE_EUID)) != 0) return (EINVAL); - error = getrlimitusage_one(curproc, uap->which, uap->flags, &res); + p = curproc; + error = getrlimitusage_one(p, p->p_vmspace, uap->which, uap->flags, + &res); if (error == 0) error = copyout(&res, uap->res, sizeof(res)); return (error); @@ -1750,6 +1752,8 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) { rlim_t resval[RLIM_NLIMITS]; struct proc *p; + struct thread *td; + struct vmspace *vm; size_t len; int error, *name, i; @@ -1759,15 +1763,20 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) if (req->newptr != NULL) return (EINVAL); - error = pget((pid_t)name[0], PGET_WANTREAD, &p); + td = curthread; + error = pget((pid_t)name[0], PGET_HOLD | PGET_NOTWEXIT, &p); if (error != 0) return (error); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); + if (error != 0) + goto out; if ((u_int)arg2 == 1) { len = sizeof(resval); memset(resval, 0, sizeof(resval)); for (i = 0; i < RLIM_NLIMITS; i++) { - error = getrlimitusage_one(p, (unsigned)i, 0, + error = getrlimitusage_one(p, vm, (unsigned)i, 0, &resval[i]); if (error == ENXIO) { resval[i] = -1; @@ -1778,7 +1787,7 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) } } else { len = sizeof(resval[0]); - error = getrlimitusage_one(p, (unsigned)name[1], 0, + error = getrlimitusage_one(p, vm, (unsigned)name[1], 0, &resval[0]); if (error == ENXIO) { resval[0] = -1; @@ -1787,6 +1796,8 @@ sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS) } if (error == 0) error = SYSCTL_OUT(req, resval, len); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); +out: PRELE(p); return (error); }