The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=85a65e3930924429903e09832d177f8aa09dfb47
commit 85a65e3930924429903e09832d177f8aa09dfb47 Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-06-06 18:02:29 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-06-09 21:11:45 +0000 proc: add tree ref count Owning the reference prevents reuse of the struct proc. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D57492 --- sys/kern/kern_exit.c | 2 +- sys/kern/kern_fork.c | 3 ++- sys/kern/kern_proc.c | 1 + sys/sys/proc.h | 7 +++++++ 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index 63e46dcf46f7..2f94386c9101 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -1107,7 +1107,7 @@ proc_reap(struct thread *td, struct proc *p, int *status, int options) KASSERT(FIRST_THREAD_IN_PROC(p), ("proc_reap: no residual thread!")); - uma_zfree(proc_zone, p); + PROC_TREE_UNREF(p); atomic_add_int(&nprocs, -1); } diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index 2fb4d9d4274d..5318a737ea35 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -1051,6 +1051,7 @@ fork1(struct thread *td, struct fork_req *fr) pages = kstack_pages; /* Allocate new proc. */ newproc = uma_zalloc(proc_zone, M_WAITOK); + PROC_TREE_REF(newproc); td2 = FIRST_THREAD_IN_PROC(newproc); if (td2 == NULL) { td2 = thread_alloc(pages); @@ -1131,7 +1132,7 @@ fail1: fail2: if (vm2 != NULL) vmspace_free(vm2); - uma_zfree(proc_zone, newproc); + PROC_TREE_UNREF(newproc); if ((flags & RFPROCDESC) != 0 && fp_procdesc != NULL) { fdclose(td, fp_procdesc, *fr->fr_pd_fd); fdrop(fp_procdesc, td); diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index 43cb1f95b4ef..68845e5aa679 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -279,6 +279,7 @@ proc_init(void *mem, int size, int flags) p->p_pgrp = NULL; TAILQ_INIT(&p->p_kqtim_stop); STAILQ_INIT(&p->p_ktr); + refcount_init(&p->p_tree_refcnt, 0); return (0); } diff --git a/sys/sys/proc.h b/sys/sys/proc.h index 5f017e6ece2c..ff6e944a5ad2 100644 --- a/sys/sys/proc.h +++ b/sys/sys/proc.h @@ -779,6 +779,7 @@ struct proc { TAILQ_HEAD(, kq_timer_cb_data) p_kqtim_stop; /* (c) */ LIST_ENTRY(proc) p_jaillist; /* (d) Jail process linkage. */ u_int p_asig; /* (c) ASYNCEXIT pending signal. */ + u_int p_tree_refcnt; /* (e) proctree refcount */ }; #define p_session p_pgrp->pg_session @@ -804,6 +805,12 @@ struct proc { #define PROC_PROFUNLOCK(p) mtx_unlock_spin(&(p)->p_profmtx) #define PROC_PROFLOCK_ASSERT(p, type) mtx_assert(&(p)->p_profmtx, (type)) +#define PROC_TREE_REF(p) refcount_acquire(&(p)->p_tree_refcnt) +#define PROC_TREE_UNREF(p) do { \ + if (refcount_release(&(p)->p_tree_refcnt)) \ + uma_zfree(proc_zone, p); \ +} while (0) + /* These flags are kept in p_flag. */ #define P_ADVLOCK 0x00000001 /* Process may hold a POSIX advisory lock. */
