⬢ DragonFlyBSD Kernel Audit
DF-2760 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
--- sys/kern/kern_prot.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/v26/fixtree/sys/kern/kern_prot.c	2026-10-24 16:33:07.789715562 +0000
@@ -150,8 +150,11 @@
 		if (pt == NULL)
 			error = ESRCH;
 	}
-	if (error == 0)
+	if (error == 0) {
+		lwkt_gettoken_shared(&pt->p_token);
 		sysmsg->sysmsg_result = pt->p_session->s_sid;
+		lwkt_reltoken(&pt->p_token);
+	}
 	if (pt)
 		PRELE(pt);
 	return (error);
@@ -364,6 +367,7 @@
 	struct pgrp *pgrp = NULL;	/* target pgrp */
 	int error;
 	int pgid = uap->pgid;
+	int holds_curp_token = 0;	/* DF-2760 */
 
 	if (pgid < 0)
 		return (EINVAL);
@@ -376,6 +380,8 @@
 			targp = NULL;
 			goto done;
 		}
+		lwkt_gettoken_shared(&curp->p_token);
+		holds_curp_token = 1;
 		lwkt_gettoken(&targp->p_token);
 		/* targp now referenced and its token is held */
 
@@ -391,6 +397,8 @@
 	} else {
 		targp = curp;
 		PHOLD(targp);
+		lwkt_gettoken_shared(&curp->p_token);
+		holds_curp_token = 1;
 		lwkt_gettoken(&targp->p_token);
 	}
 	if (SESS_LEADER(targp)) {
@@ -410,6 +418,8 @@
 done:
 	if (pgrp)
 		pgrel(pgrp);
+	if (holds_curp_token)
+		lwkt_reltoken(&curp->p_token);
 	if (targp) {
 		lwkt_reltoken(&targp->p_token);
 		PRELE(targp);