- Change fill_kinfo_proc() to require that the process is locked when it

  is called.
- Change sysctl_out_proc() to require that the process is locked when it
  is called and to drop the lock before it returns.  If this proves too
  complex we can change sysctl_out_proc() to simply acquire the lock at
  the very end and have the calling code drop the lock right after it
  returns.
- Lock the process we are going to export before the p_cansee() in the
  loop in sysctl_kern_proc() and hold the lock until we call
  sysctl_out_proc().
- Don't call p_cansee() on the process about to be exported twice in
  the aforementioned loop.

2 files changed, 7 insertions, 4 deletions

diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c
index f818651..3344ca1 100644
--- a/sys/compat/linprocfs/linprocfs.c
+++ b/sys/compat/linprocfs/linprocfs.c
@@ -489,12 +489,12 @@ linprocfs_doprocstat(PFS_FILL_ARGS)
 {
 	struct kinfo_proc kp;
 
+	PROC_LOCK(p);
 	fill_kinfo_proc(p, &kp);
 	sbuf_printf(sb, "%d", p->p_pid);
 #define PS_ADD(name, fmt, arg) sbuf_printf(sb, " " fmt, arg)
 	PS_ADD("comm",		"(%s)",	p->p_comm);
 	PS_ADD("statr",		"%c",	'0'); /* XXX */
-	PROC_LOCK(p);
 	PS_ADD("ppid",		"%d",	p->p_pptr ? p->p_pptr->p_pid : 0);
 	PS_ADD("pgrp",		"%d",	p->p_pgid);
 	PS_ADD("session",	"%d",	p->p_session->s_sid);
@@ -571,6 +571,7 @@ linprocfs_doprocstatus(PFS_FILL_ARGS)
 		state = state_str[(int)p->p_stat];
 	mtx_unlock_spin(&sched_lock);
 
+	PROC_LOCK(p);
 	fill_kinfo_proc(p, &kp);
 	sbuf_printf(sb, "Name:\t%s\n",		p->p_comm); /* XXX escape */
 	sbuf_printf(sb, "State:\t%s\n",		state);
@@ -579,7 +580,6 @@ linprocfs_doprocstatus(PFS_FILL_ARGS)
 	 * Credentials
 	 */
 	sbuf_printf(sb, "Pid:\t%d\n",		p->p_pid);
-	PROC_LOCK(p);
 	sbuf_printf(sb, "PPid:\t%d\n",		p->p_pptr ?
 						p->p_pptr->p_pid : 0);
 	sbuf_printf(sb, "Uid:\t%d %d %d %d\n",	p->p_ucred->cr_ruid,
diff --git a/sys/compat/pecoff/imgact_pecoff.c b/sys/compat/pecoff/imgact_pecoff.c
index 4656899..8196aa1 100644
--- a/sys/compat/pecoff/imgact_pecoff.c
+++ b/sys/compat/pecoff/imgact_pecoff.c
@@ -163,7 +163,8 @@ pecoff_coredump(register struct thread * td, register struct vnode * vp,
 		off_t limit)
 {
 	register struct ucred *cred = td->td_ucred;
-	register struct vmspace *vm = td->td_proc->p_vmspace;
+	struct proc *p = td->td_proc;
+	register struct vmspace *vm = p->p_vmspace;
 	int             error;
 #ifdef PECOFF_DEBUG
 	struct vm_map  *map;
@@ -173,7 +174,9 @@ pecoff_coredump(register struct thread * td, register struct vnode * vp,
 #endif
 	if (ctob((UAREA_PAGES+KSTACK_PAGES) + vm->vm_dsize + vm->vm_ssize) >= limit)
 		return (EFAULT);
-	fill_kinfo_proc(td->td_proc, &td->td_proc->p_uarea->u_kproc);
+	PROC_LOCK(p);
+	fill_kinfo_proc(p, &p->p_uarea->u_kproc);
+	PROC_UNLOCK(p);
 
 #if PECOFF_DEBUG
 	fill_regs(td, &regs);