DragonFlyBSD Kernel Audit
DF-2791 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -702,6 +702,19 @@
 
 	/* XXX lwp */
 	lp = FIRST_LWP_IN_PROC(p);
+	if (lp == NULL) {
+		/*
+		 * The process can be observed with no lwps during its
+		 * fork (SIDL) window: it is on allproc (visible to
+		 * pfind(), which only skips SZOMB) from
+		 * proc_add_allproc() until the first lwp is inserted
+		 * into p_lwp_tree by lwp_fork2().
+		 */
+		error = ESRCH;
+		goto done;
+	}
+	/* like sys_lwp_rtprio(): don't let a blocking copyout rip lp */
+	LWPHOLD(lp);
 	switch (uap->function) {
 	case RTP_LOOKUP:
 		error = copyout(&lp->lwp_rtprio, uap->rtp,
@@ -757,6 +770,7 @@
 		error = EINVAL;
 		break;
 	}
+	LWPRELE(lp);
 done:
 	if (p) {
 		lwkt_reltoken(&p->p_token);