The branch stable/13 has been updated by kib:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=b18df35be04213e6a603b54d404215a923fe66e2

commit b18df35be04213e6a603b54d404215a923fe66e2
Author:     Konstantin Belousov <[email protected]>
AuthorDate: 2022-05-15 22:52:09 +0000
Commit:     Konstantin Belousov <[email protected]>
CommitDate: 2022-06-24 14:45:46 +0000

    reap_kill_subtree(): hold the reaper when entering it into the queue to 
handle later
    
    (cherry picked from commit e0343eacf36588bf503c7a59c0cc436294223839)
---
 sys/kern/kern_procctl.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/sys/kern/kern_procctl.c b/sys/kern/kern_procctl.c
index 02469f25bc3d..b32a4156dafb 100644
--- a/sys/kern/kern_procctl.c
+++ b/sys/kern/kern_procctl.c
@@ -336,11 +336,25 @@ reap_kill_sched(struct reap_kill_tracker_head *tracker, 
struct proc *p2)
 {
        struct reap_kill_tracker *t;
 
+       PROC_LOCK(p2);
+       if ((p2->p_flag2 & P2_WEXIT) != 0) {
+               PROC_UNLOCK(p2);
+               return;
+       }
+       _PHOLD_LITE(p2);
+       PROC_UNLOCK(p2);
        t = malloc(sizeof(struct reap_kill_tracker), M_TEMP, M_WAITOK);
        t->parent = p2;
        TAILQ_INSERT_TAIL(tracker, t, link);
 }
 
+static void
+reap_kill_sched_free(struct reap_kill_tracker *t)
+{
+       PRELE(t->parent);
+       free(t, M_TEMP);
+}
+
 static void
 reap_kill_children(struct thread *td, struct proc *reaper,
     struct procctl_reaper_kill *rk, ksiginfo_t *ksi, int *error)
@@ -379,7 +393,7 @@ reap_kill_subtree_once(struct thread *td, struct proc *p, 
struct proc *reaper,
                 * reaper, which should handle it.
                 */
                if ((t->parent->p_treeflag & P_TREE_REAPER) == 0) {
-                       free(t, M_TEMP);
+                       reap_kill_sched_free(t);
                        res = true;
                        continue;
                }
@@ -396,7 +410,7 @@ reap_kill_subtree_once(struct thread *td, struct proc *p, 
struct proc *reaper,
                        reap_kill_proc(td, p2, ksi, rk, error);
                        res = true;
                }
-               free(t, M_TEMP);
+               reap_kill_sched_free(t);
        }
        return (res);
 }

Reply via email to