The branch stable/14 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=23ebf0c97ac5fcd6adb6cda8a8707b99257721a6
commit 23ebf0c97ac5fcd6adb6cda8a8707b99257721a6 Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-06-15 13:32:47 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-06-28 00:29:02 +0000 kern_procctl(PROC_WX_MAPPINGS_PERMIT): ensure stability of the target vmspace (cherry picked from commit 6a572920f251ac8ac6a80a55d4d039736ea7dd65) --- sys/kern/kern_procctl.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/sys/kern/kern_procctl.c b/sys/kern/kern_procctl.c index 23b3403fec4f..bdcb4d544cc6 100644 --- a/sys/kern/kern_procctl.c +++ b/sys/kern/kern_procctl.c @@ -40,6 +40,7 @@ #include <sys/priv.h> #include <sys/proc.h> #include <sys/procctl.h> +#include <sys/ptrace.h> #include <sys/sx.h> #include <sys/syscallsubr.h> #include <sys/sysproto.h> @@ -872,37 +873,41 @@ wxmap_ctl(struct thread *td, struct proc *p, void *data) { struct vmspace *vm; vm_map_t map; - int state; + int error, state; PROC_LOCK_ASSERT(p, MA_OWNED); if ((p->p_flag & P_WEXIT) != 0) return (ESRCH); state = *(int *)data; + error = 0; switch (state) { case PROC_WX_MAPPINGS_PERMIT: - p->p_flag2 |= P2_WXORX_DISABLE; - _PHOLD(p); PROC_UNLOCK(p); - vm = vmspace_acquire_ref(p); - if (vm != NULL) { + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_DEBUG, &vm); + if (error == 0) { map = &vm->vm_map; vm_map_lock(map); map->flags &= ~MAP_WXORX; vm_map_unlock(map); - vmspace_free(vm); + PROC_LOCK(p); + p->p_flag2 |= P2_WXORX_DISABLE; + PROC_UNLOCK(p); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_DEBUG, vm); } PROC_LOCK(p); - _PRELE(p); break; case PROC_WX_MAPPINGS_DISALLOW_EXEC: p->p_flag2 |= P2_WXORX_ENABLE_EXEC; break; default: - return (EINVAL); + error = EINVAL; + break; } - return (0); + return (error); } static int
