Page MenuHomeFreeBSD

proc: Disallow re-enabling of process itimers during exit
ClosedPublic

Authored by markj on Mar 27 2025, 10:32 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Sep 12, 2:03 PM
Unknown Object (File)
Tue, Sep 8, 8:35 PM
Unknown Object (File)
Sat, Sep 5, 5:39 AM
Unknown Object (File)
Sat, Sep 5, 4:23 AM
Unknown Object (File)
Fri, Sep 4, 8:32 PM
Unknown Object (File)
Fri, Sep 4, 7:52 PM
Unknown Object (File)
Fri, Sep 4, 6:56 PM
Unknown Object (File)
Thu, Sep 3, 11:06 PM
Subscribers

Details

Summary

During process exit, it's possible for the exiting thread to send a
signal to its process, via killjobc(). This happens after the itimer is
drained. If itimers are stopped, i.e., P2_ITSTOPPED is set, then
itimer_proc_continue() will resume the callout after it has been
drained.

Fix the problem by simply clearing P2_ITSTOPPED as part of the drain.
Then, a signal received after that point will not re-enable the callout.

Reported by: syzkaller

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

I think this is fine.
But also I suggest to add the check for P_WEXIT/P_KILLED before re-arming the itimer callouts.

This revision is now accepted and ready to land.Mar 27 2025, 4:59 PM

Check for P_WEXIT in realitexpire_reset_callout() too.

This revision now requires review to proceed.Mar 28 2025, 8:54 AM
This revision is now accepted and ready to land.Mar 28 2025, 3:22 PM