The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=bcdb6ba94d08554eeb9bde4d2468707a612f5d90
commit bcdb6ba94d08554eeb9bde4d2468707a612f5d90 Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-07-15 17:30:51 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-08-01 10:41:45 +0000 processes: add zombie references, each of them prevents reap Add the p_zombieref bitmask into struct proc, which enumerates all legitimate waiters on the process exit status. Among them are parent for PZOMBIEREF_PARENT, and the holder of the process descriptor for PZOMBIEREF_PROCDESC, if the process was created by pdfork(). Require all zombie refs to be cleared to reap zombie. This prevents stealing the exit status from the parent by pdwait()ing on a procdesc obtained by pdopenpid(), or by waitpid() by debugger from the real parent. Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58264 --- sys/kern/kern_exit.c | 58 ++++++++++++++++++++++++++++--------------------- sys/kern/kern_fork.c | 9 ++++++++ sys/kern/sys_procdesc.c | 48 +++++++++++++++++++++++++++------------- sys/sys/proc.h | 12 +++++++++- sys/sys/procdesc.h | 6 +++-- 5 files changed, 90 insertions(+), 43 deletions(-) diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index b61fb7bcf2f1..efdd51e2ec97 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -683,8 +683,7 @@ exit1(struct thread *td, int rval, int signo) * exit(). */ signal_parent = 0; - procdesc_exit(p); - if (p->p_procdesc == NULL) { + if (p->p_procdesc == NULL || procdesc_exit(p)) { /* * Notify parent that we're gone. If parent has the * PS_NOCLDWAIT flag set, or if the handler is set to SIG_IGN, @@ -986,7 +985,8 @@ sys_pdwait(struct thread *td, struct pdwait_args *uap) * lock as part of its work. */ void -proc_reap(struct thread *td, struct proc *p, int *status, int options) +proc_reap(struct thread *td, struct proc *p, int *status, int options, + int zombieref) { struct proc *q, *t; @@ -1010,6 +1010,13 @@ proc_reap(struct thread *td, struct proc *p, int *status, int options) return; } + p->p_zombieref &= ~zombieref; + if ((p->p_zombieref & PZOMBIEREF_REFMASK) != 0) { + sx_xunlock(&proctree_lock); + PROC_UNLOCK(p); + return; + } + PROC_LOCK(q); sigqueue_take(p->p_ksi); PROC_UNLOCK(q); @@ -1192,9 +1199,8 @@ proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id, switch (idtype) { case P_ALL: - if (p->p_procdesc == NULL || - (p->p_pptr == td->td_proc && - (p->p_flag & P_TRACED) != 0)) { + if ((p->p_zombieref & PZOMBIEREF_PARENT) != 0 || + (p->p_pptr == td->td_proc && (p->p_flag & P_TRACED) != 0)) { break; } @@ -1246,14 +1252,17 @@ proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id, return (0); } - if (p_canwait(td, p)) { + if (p_canwait(td, p) != 0 || + ((options & WEXITED) == 0 && p->p_state == PRS_ZOMBIE) || + /* waitpid() is disabled and waiter is not the debugger */ + ((p->p_zombieref & PZOMBIEREF_PARENT) == 0 && + (p->p_pptr != td->td_proc || (p->p_flag & P_TRACED) == 0))) { PROC_UNLOCK(p); return (0); } - - if ((options & WEXITED) == 0 && p->p_state == PRS_ZOMBIE) { + if (check_only) { PROC_UNLOCK(p); - return (0); + return (1); } /* @@ -1279,8 +1288,8 @@ proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id, */ wait_fill_wrusage(p, wrusage); - if (p->p_state == PRS_ZOMBIE && !check_only) { - proc_reap(td, p, status, options); + if (p->p_state == PRS_ZOMBIE) { + proc_reap(td, p, status, options, PZOMBIEREF_PARENT); return (-1); } return (1); @@ -1481,18 +1490,6 @@ loop_locked: return (0); } - /* - * When running in capsicum(4) mode, make wait(2) ignore - * processes created with pdfork(2). This is because one can - * disown them - by passing their process descriptor to another - * process - which means it needs to be prevented from touching - * them afterwards. - */ - if (IN_CAPABILITY_MODE(td) && p->p_procdesc != NULL) { - PROC_UNLOCK(p); - continue; - } - nfound++; PROC_LOCK_ASSERT(p, MA_OWNED); @@ -1523,7 +1520,6 @@ loop_locked: if (ret != 0) { KASSERT(ret != -1, ("reaped an orphan (pid %d)", (int)td->td_retval[0])); - PROC_UNLOCK(p); nfound++; break; } @@ -1678,6 +1674,18 @@ proc_reparent(struct proc *child, struct proc *parent, bool set_oppid) child->p_pptr = parent; if (set_oppid) child->p_oppid = parent->p_pid; + + /* + * When reparenting the child to the real parent which expects + * to be able to call waitpid(), or reaper, re-enable + * waitpid(2) for it, so that the zombie can be collected. + */ + if ((child->p_flag & P_TRACED) == 0 && + ((proc_realparent(child) == parent && + (child->p_zombieref & PZOMBIEREF_NEEDPARENT) != 0) + || child->p_reaper == parent) && + (child->p_zombieref & PZOMBIEREF_PARENT) == 0) + child->p_zombieref |= PZOMBIEREF_PARENT; } static void diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index e3d7b39e687a..7d2535de987f 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -547,6 +547,15 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * P2_STKGAP_DISABLE | P2_STKGAP_DISABLE_EXEC | P2_NO_NEW_PRIVS | P2_WXORX_DISABLE | P2_WXORX_ENABLE_EXEC | P2_LOGSIGEXIT_CTL | P2_LOGSIGEXIT_ENABLE); + if ((fr->fr_flags & RFPROCDESC) != 0) { + p2->p_zombieref = PZOMBIEREF_PROCDESC; + if ((fr->fr_pd_flags & PD_NOWAITPID) == 0 && + (fr->fr_flags & RFNOWAIT) == 0) + p2->p_zombieref |= (PZOMBIEREF_PARENT | + PZOMBIEREF_NEEDPARENT); + } else { + p2->p_zombieref = PZOMBIEREF_PARENT | PZOMBIEREF_NEEDPARENT; + } p2->p_swtick = ticks; if (p1->p_flag & P_PROFIL) startprofclock(p2); diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c index a605633fbca5..289b9f100897 100644 --- a/sys/kern/sys_procdesc.c +++ b/sys/kern/sys_procdesc.c @@ -277,8 +277,10 @@ procdesc_free(struct procdesc *pd) * procdesc_exit() - notify a process descriptor that its process is exiting. * We use the proctree_lock to ensure that process exit either happens * strictly before or strictly after a concurrent call to procdesc_close(). + * Return true if the process' parent is responsible for reaping the child, + * false otherwise. */ -void +bool procdesc_exit(struct proc *p) { struct procdesc *pd; @@ -289,7 +291,7 @@ procdesc_exit(struct proc *p) pd = p->p_procdesc; if (pd == NULL) - return; + goto out; PROCDESC_LOCK(pd); KASSERT(pd->pd_fpcount > 0, ("%s: closed procdesc %p", __func__, pd)); @@ -304,6 +306,8 @@ procdesc_exit(struct proc *p) /* Wakeup all waiters for this procdesc' process exit. */ wakeup(&p->p_procdesc); +out: + return ((p->p_zombieref & PZOMBIEREF_PARENT) != 0); } void @@ -418,15 +422,7 @@ procdesc_close(struct file *fp, struct thread *td) } else { PROC_LOCK(p); AUDIT_ARG_PROCESS(p); - if (p->p_state == PRS_ZOMBIE) { - /* - * If the process is already dead and just awaiting - * reaping, do that now. This will release the - * process's reference to the process descriptor when it - * calls back into procdesc_reap(). - */ - proc_reap(curthread, p, NULL, 0); - } else if (pd->pd_fpcount == 0) /* last procdesc */ { + if (pd->pd_fpcount == 0) /* last procdesc */ { /* * If the process is not yet dead, we need to kill it, * but we can't wait around synchronously for it to go @@ -438,9 +434,27 @@ procdesc_close(struct file *fp, struct thread *td) p->p_procdesc = NULL; pd->pd_pid = -1; procdesc_free(pd); + if (p->p_state == PRS_ZOMBIE) { + proc_reap(curthread, p, NULL, 0, + PZOMBIEREF_PROCDESC); + goto out; + } - /* Failed finstall() should not cause reaping. */ - if ((fp->f_pdflags & F_PD_NOFINSTALL) == 0) { + /* + * Not a zombie, and no more opened process + * descriptors. Clear PZOMBIEREF_PROCDESC + * since right now nobody would call + * proc_reap(p, PZOMBIEREF_PROCDESC). The + * flag is re-added if pdopenpid() is called. + */ + p->p_zombieref &= ~PZOMBIEREF_PROCDESC; + + /* + * A reference for waitpid() or failed + * finstall() should not cause reaping. + */ + if ((fp->f_pdflags & F_PD_NOFINSTALL) == 0 && + (p->p_zombieref & PZOMBIEREF_PARENT) == 0) { /* * Next, reparent it to its reaper * (usually init(8)) so that there's @@ -456,12 +470,13 @@ procdesc_close(struct file *fp, struct thread *td) proc_add_orphan(p, p->p_reaper); } } + procdesc_close_tail(fp, p); } else { procdesc_close_tail(fp, p); } } - +out: /* * Release the file descriptor's reference on the process descriptor. */ @@ -652,6 +667,7 @@ pdopenpid1(struct thread *td, pid_t pid, struct procdesc **pdf, struct file *fp) } pd = p->p_procdesc; if (pd != NULL) { + MPASS((p->p_zombieref & PZOMBIEREF_PROCDESC) != 0); refcount_acquire(&pd->pd_refcount); PROCDESC_LOCK(pd); MPASS(pd->pd_fpcount > 0); @@ -663,6 +679,8 @@ pdopenpid1(struct thread *td, pid_t pid, struct procdesc **pdf, struct file *fp) pd->pd_proc = p; pd->pd_pid = p->p_pid; p->p_procdesc = pd; + MPASS((p->p_zombieref & PZOMBIEREF_PROCDESC) == 0); + p->p_zombieref |= PZOMBIEREF_PROCDESC; } procdesc_finit(pd, fp); PROC_UNLOCK(p); @@ -718,7 +736,7 @@ sys_pdopenpid(struct thread *td, struct pdopenpid_args *args) AUDIT_ARG_PID(args->pid); AUDIT_ARG_FFLAGS(args->flags); - if ((args->flags & ~(PD_ALLOWED_AT_FORK)) != 0) + if ((args->flags & ~(PD_ALLOWED_AT_OPENPID)) != 0) return (EINVAL); return (kern_pdopenpid(td, args->pid, args->flags)); } diff --git a/sys/sys/proc.h b/sys/sys/proc.h index cd2d4a318992..c052540cece5 100644 --- a/sys/sys/proc.h +++ b/sys/sys/proc.h @@ -782,6 +782,7 @@ struct proc { LIST_ENTRY(proc) p_jaillist; /* (d) Jail process linkage. */ u_int p_asig; /* (c) ASYNCEXIT pending signal. */ u_int p_tree_refcnt; /* (e) proctree refcount */ + u_int p_zombieref; /* (e) References for reap. */ }; #define p_session p_pgrp->pg_session @@ -911,6 +912,14 @@ struct proc { #define P_TREE_REAPER 0x00000004 /* Reaper of subtree */ #define P_TREE_GRPEXITED 0x00000008 /* exit1() done with job ctl */ +/* + * p_zombieref; protected by proctree_lock. + */ +#define PZOMBIEREF_PARENT 0x00000001 /* Ref for waitpid() */ +#define PZOMBIEREF_PROCDESC 0x00000002 /* Ref for pdwait() */ +#define PZOMBIEREF_NEEDPARENT 0x80000000 /* Had ref for waitpid() */ +#define PZOMBIEREF_REFMASK (PZOMBIEREF_PARENT | PZOMBIEREF_PROCDESC) + /* * These were process status values (p_stat), now they are only used in * legacy conversion code. @@ -1205,7 +1214,8 @@ int proc_iterate(int (*cb)(struct proc *, void *), void *cbarg); void proc_linkup0(struct proc *p, struct thread *td); void proc_linkup(struct proc *p, struct thread *td); struct proc *proc_realparent(struct proc *child); -void proc_reap(struct thread *td, struct proc *p, int *status, int options); +void proc_reap(struct thread *td, struct proc *p, int *status, int options, + int zombieref); void proc_reparent(struct proc *child, struct proc *newparent, bool set_oppid); void proc_set_p2_wexit(struct proc *p); void proc_set_traced(struct proc *p, bool stop); diff --git a/sys/sys/procdesc.h b/sys/sys/procdesc.h index f912f8787fd9..0c923509f6eb 100644 --- a/sys/sys/procdesc.h +++ b/sys/sys/procdesc.h @@ -108,7 +108,7 @@ struct procdesc { /* * In-kernel interfaces to process descriptors. */ -void procdesc_exit(struct proc *); +bool procdesc_exit(struct proc *); void procdesc_fork(struct proc *p, pid_t child_pid); void procdesc_jobstate(struct proc *p); int kern_pdgetpid(struct thread *, int fd, const cap_rights_t *, @@ -160,7 +160,9 @@ __END_DECLS */ #define PD_DAEMON 0x00000001 /* Don't exit when procdesc closes. */ #define PD_CLOEXEC 0x00000002 /* Close file descriptor on exec. */ +#define PD_NOWAITPID 0x00000004 /* Reap without waitpid(). */ -#define PD_ALLOWED_AT_FORK (PD_DAEMON | PD_CLOEXEC) +#define PD_ALLOWED_AT_FORK (PD_DAEMON | PD_CLOEXEC | PD_NOWAITPID) +#define PD_ALLOWED_AT_OPENPID (PD_DAEMON | PD_CLOEXEC) #endif /* !_SYS_PROCDESC_H_ */
