PERFORCE change 91398 for review

[John Baldwin]

http://perforce.freebsd.org/chv.cgi?CH=91398

Change 91398 by jhb at jhb_slimer on 2006/02/08 16:54:49

	- Add P_WEXIT checks to ptrace() and act like the process doesn't
	  exist if P_WEXIT is set.
	- Remove unneeded PHOLD's from PT_SUSPEND, PT_RESUME, and PT_LWPINFO.
	- Don't drop proc lock around ptrace_single_step for PT_STEP
	  since we don't for PT_SETSTEP.
	- Add missing PHOLD's for PT_{READ,WRITE}_[ID], PT_IO, and
	  PT_GETLWPLIST.
	- Don't leak the proc lock if PT_LWPINFO fails with EINVAL.

Affected files ...

.. //depot/projects/smpng/sys/i386/linux/linux_ptrace.c#13 edit
.. //depot/projects/smpng/sys/kern/sys_process.c#48 edit

Differences ...

==== //depot/projects/smpng/sys/i386/linux/linux_ptrace.c#13 (text+ko) ====

@@ -356,6 +356,12 @@
 			break;
 		}
 
+		/* Exiting processes can't be debugged. */
+		if ((p->p_flag & P_WEXIT) != 0) {
+			error = ESRCH;
+			goto fail;
+		}
+
 		if ((error = p_candebug(td, p)) != 0)
 			goto fail;
 

==== //depot/projects/smpng/sys/kern/sys_process.c#48 (text+ko) ====

@@ -551,6 +551,11 @@
 			pid = p->p_pid;
 		}
 	}
+
+	if ((p->p_flag & P_WEXIT) != 0) {
+		error = ESRCH;
+		goto fail;
+	}
 	if ((error = p_cansee(td, p)) != 0)
 		goto fail;
 
@@ -712,20 +717,16 @@
 		return (0);
 
 	case PT_SUSPEND:
-		_PHOLD(p);
 		mtx_lock_spin(&sched_lock);
 		td2->td_flags |= TDF_DBSUSPEND;
 		mtx_unlock_spin(&sched_lock);
-		_PRELE(p);
 		PROC_UNLOCK(p);
 		return (0);
 
 	case PT_RESUME:
-		_PHOLD(p);
 		mtx_lock_spin(&sched_lock);
 		td2->td_flags &= ~TDF_DBSUSPEND;
 		mtx_unlock_spin(&sched_lock);
-		_PRELE(p);
 		PROC_UNLOCK(p);
 		return (0);
 
@@ -745,13 +746,11 @@
 
 		switch (req) {
 		case PT_STEP:
-			PROC_UNLOCK(p);
 			error = ptrace_single_step(td2);
 			if (error) {
-				PRELE(p);
-				goto fail_noproc;
+				_PRELE(p);
+				goto fail;
 			}
-			PROC_LOCK(p);
 			break;
 		case PT_TO_SCE:
 			p->p_stops |= S_PT_SCE;
@@ -844,6 +843,7 @@
 		/* FALLTHROUGH */
 	case PT_READ_I:
 	case PT_READ_D:
+		_PHOLD(p);
 		PROC_UNLOCK(p);
 		tmp = 0;
 		/* write = 0 set above */
@@ -857,6 +857,7 @@
 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
 		uio.uio_td = td;
 		error = proc_rwmem(p, &uio);
+		PRELE(p);
 		if (uio.uio_resid != 0) {
 			/*
 			 * XXX proc_rwmem() doesn't currently return ENOSPC,
@@ -875,6 +876,7 @@
 		return (error);
 
 	case PT_IO:
+		_PHOLD(p);
 		PROC_UNLOCK(p);
 #ifdef COMPAT_IA32
 		if (wrap32) {
@@ -911,9 +913,11 @@
 			uio.uio_rw = UIO_WRITE;
 			break;
 		default:
+			PRELE(p);
 			return (EINVAL);
 		}
 		error = proc_rwmem(p, &uio);
+		PRELE(p);
 #ifdef COMPAT_IA32
 		if (wrap32)
 			piod32->piod_len -= uio.uio_resid;
@@ -969,10 +973,11 @@
 		return (error);
 
 	case PT_LWPINFO:
-		if (data == 0 || data > sizeof(*pl))
-			return (EINVAL);
+		if (data == 0 || data > sizeof(*pl)) {
+			error = EINVAL;
+			goto fail;
+		}
 		pl = addr;
-		_PHOLD(p);
 		pl->pl_lwpid = td2->td_tid;
 		if (td2->td_flags & TDF_XSIG)
 			pl->pl_event = PL_EVENT_SIGNAL;
@@ -985,7 +990,6 @@
 		} else {
 			pl->pl_flags = 0;
 		}
-		_PRELE(p);
 		PROC_UNLOCK(p);
 		return (0);
 
@@ -996,10 +1000,11 @@
 
 	case PT_GETLWPLIST:
 		if (data <= 0) {
-			PROC_UNLOCK(p);
-			return (EINVAL);
+			error = EINVAL;
+			goto fail;
 		}
 		num = imin(p->p_numthreads, data);
+		_PHOLD(p);
 		PROC_UNLOCK(p);
 		buf = malloc(num * sizeof(lwpid_t), M_TEMP, M_WAITOK);
 		tmp = 0;
@@ -1011,6 +1016,7 @@
 			buf[tmp++] = td2->td_tid;
 		}
 		mtx_unlock_spin(&sched_lock);
+		_PRELE(p);
 		PROC_UNLOCK(p);
 		error = copyout(buf, addr, tmp * sizeof(lwpid_t));
 		free(buf, M_TEMP);