DF-2828 — CKPT_THAW from a multi-threaded process violates vmspace_exec()'s single-thread contract

• File: sys/kern/kern_checkpoint.c (call site) / sys/vm/vm_map.c / sys/platform/pc64/x86_64/pmap.c (victim contract)
• Bug line: kern_checkpoint.c:556 — elf_gettextvp() calls vmspace_exec(p, NULL) while other threads of p are still running. vmspace_exec() → pmap_replacevm() begins with KKASSERT(p->p_nthreads == 1) (pmap.c:6378) and only re-points the first LWP (lp = RB_ROOT(&p->p_lwp_tree)), then releases the old vmspace (vmspace_rel(oldvmspace), vm_map.c:4330). kern_exec guarantees single-threadedness before calling it; ckpt_thaw_proc() does not — it never stops the process's other LWPs (contrast ckpt_freeze_proc() at kern_checkpoint.c:696-702 which does proc_stop(p, SCORE) + waits).

Run (guest, root; stock INVARIANTS kernel)

cc -O -o trigger_mt trigger_mt.c -lpthread
./gen clean.ckpt stage2.bin normal 0x600000f0 0     # any parseable image
./trigger_mt                                          # 2 threads + THAW

Expected

panic: assertion "p->p_nthreads == 1" failed in pmap_replacevm at /usr/src/sys/platform/pc64/x86_64/pmap.c:6378
pmap_replacevm() at pmap_replacevm+0xb9
vmspace_exec() at vmspace_exec+0x6a
sys_sys_checkpoint() at sys_sys_checkpoint+0x6a1
sys_xsyscall() at sys_xsyscall+0x89
syscall2() at syscall2+0x11e
Debugger("panic")

Impact

• INVARIANTS kernels (incl. the stock audit guest): deterministic local kernel panic (DoS), gated by kern.ckptgroup (wheel by default).
• Non-INVARIANTS production kernels (analysis, not run here): the assertion is compiled out; pmap_replacevm updates only the first LWP's lwp_vmspace, while vmspace_exec() drops the process's reference on the old vmspace. Other LWPs keep lwp_vmspace pointing into the released vmspace/pmap and can still take user faults or context-switch through it → use-after-free of struct vmspace/pmap.

Recommended fix

Reject (or serialize) multi-threaded THAW before vmspace_exec() in ckpt_thaw_proc()/elf_gettextvp():

    vmspace_exec(p, NULL);

either return EINVAL when p->p_nthreads > 1 at the top of sys_sys_checkpoint()'s CKPT_THAW case, or stop the other LWPs the way ckpt_freeze_proc() does (proc_stop(p, SCORE) + wait for p->p_nstopped == p->p_nthreads - 1, then unstop after the restore).

Fix not kernel-validated in this run (the assertion fix is a policy change best decided upstream); the panic reproduction is in panic.txt.