DF-3235 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 | --- a/sys/vfs/procfs/procfs_status.c +++ b/sys/vfs/procfs/procfs_status.c @@ -39,7 +39,10 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/uio.h> +#include <sys/refcount.h> #include <sys/malloc.h> + +MALLOC_DECLARE(M_PARGS); #include <sys/proc.h> #include <sys/caps.h> #include <sys/jail.h> @@ -48,6 +51,8 @@ #include <sys/resourcevar.h> #include <vfs/procfs/procfs.h> +MALLOC_DECLARE(M_PARGS); + #include <vm/vm.h> #include <vm/pmap.h> #include <vm/vm_param.h> @@ -186,11 +191,20 @@ int i; size_t bytes_left, done; size_t buflen; + struct pargs *pa; + char *snap; if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); /* + * Snapshot buffer. Allocated before any target pointers are + * captured so a blocking allocation cannot invalidate anything. + */ + snap = kmalloc(UPMAP_MAXPROCTITLE, M_TEMP, M_WAITOK); + pa = NULL; + + /* * If we are using the ps/cmdline caching, use that. Otherwise * revert back to the old way which only implements full cmdline * for the current process and just p->p_comm for all other @@ -215,6 +229,15 @@ if (bp[buflen] == 0) break; } + /* + * The scan above is non-blocking, but uiomove() below can + * block; blocking drops the p_token held by our caller + * (pfs_pfind) and lwp_userunmap() could then free the lpmap. + * Copy the title while we are guaranteed non-blocking. + */ + bcopy(bp, snap, buflen); + snap[buflen] = 0; + bp = snap; buf = NULL; } else if (p->p_upmap != NULL && p->p_upmap->proc_title[0] && (ps_argsopen || (CHECKIO(curp, p) && @@ -232,14 +255,31 @@ if (bp[buflen] == 0) break; } + /* same as above: proc_userunmap() vs blocking uiomove() */ + bcopy(bp, snap, buflen); + snap[buflen] = 0; + bp = snap; buf = NULL; } else if (p->p_args && (ps_argsopen || (CHECKIO(curp, p) && (p->p_flags & P_INEXEC) == 0 && !p_trespass(curp->p_ucred, p->p_ucred)) )) { - bp = p->p_args->ar_args; - buflen = p->p_args->ar_length; + /* + * execve() in the target can free p_args while uiomove() + * blocks (p_token is dropped on block). Hold a reference, + * exactly like sysctl_kern_proc_args() does, and copy the + * (small) arguments into our snapshot buffer. + */ + pa = p->p_args; + refcount_acquire(&pa->ar_ref); + buflen = pa->ar_length; + if (buflen <= UPMAP_MAXPROCTITLE) { + bcopy(pa->ar_args, snap, buflen); + bp = snap; + } else { + bp = pa->ar_args; /* reference keeps it alive */ + } buf = NULL; } else if (p != curp) { bp = p->p_comm; @@ -290,7 +330,13 @@ } error = uiomove_frombuf(bp, buflen, uio); + if (pa) { + if (refcount_release(&pa->ar_ref)) + kfree(pa, M_PARGS); + pa = NULL; + } if (buf) kfree(buf, M_TEMP); + kfree(snap, M_TEMP); return (error); } |