- p_cansee() needs the target process locked.

- We need the proc lock held for more of procfs_doprocstatus().

1 files changed, 17 insertions, 18 deletions

diff --git a/sys/fs/procfs/procfs_status.c b/sys/fs/procfs/procfs_status.c
index 86563ec..b03f4dc 100644
--- a/sys/fs/procfs/procfs_status.c
+++ b/sys/fs/procfs/procfs_status.c
@@ -109,7 +109,6 @@ procfs_doprocstatus(PFS_FILL_ARGS)
 		sep = ",";
 	}
 	SESS_UNLOCK(sess);
-	PROC_UNLOCK(p);
 	if (*sep != ',') {
 		sbuf_printf(sb, "noflags");
 	}
@@ -160,6 +159,7 @@ procfs_doprocstatus(PFS_FILL_ARGS)
 	} else {
 		sbuf_printf(sb, " -");
 	}
+	PROC_UNLOCK(p);
 	sbuf_printf(sb, "\n");
 
 	return (0);
@@ -181,23 +181,22 @@ procfs_doproccmdline(PFS_FILL_ARGS)
 	 * Linux behaviour is to return zero-length in this case.
 	 */
 
-	if (ps_argsopen || !p_cansee(td->td_proc, p)) {
-		PROC_LOCK(p);
-		if (p->p_args) {
-			sbuf_bcpy(sb, p->p_args->ar_args, p->p_args->ar_length);
-			PROC_UNLOCK(p);
-		} else if (p != td->td_proc) {
-			sbuf_printf(sb, "%.*s", MAXCOMLEN, p->p_comm);
-			PROC_UNLOCK(p);
-		} else {
-			PROC_UNLOCK(p);
-			error = copyin((void*)PS_STRINGS, &pstr, sizeof(pstr));
-			if (error)
-				return (error);
-			for (i = 0; i < pstr.ps_nargvstr; i++) {
-				sbuf_copyin(sb, pstr.ps_argvstr[i], 0);
-				sbuf_printf(sb, "%c", '\0');
-			}
+	PROC_LOCK(p);
+	if (p->p_args && (ps_argsopen || !p_cansee(td->td_proc, p))) {
+		sbuf_bcpy(sb, p->p_args->ar_args, p->p_args->ar_length);
+		PROC_UNLOCK(p);
+		return (0);
+	}
+	PROC_UNLOCK(p);
+	if (p != td->td_proc) {
+		sbuf_printf(sb, "%.*s", MAXCOMLEN, p->p_comm);
+	} else {
+		error = copyin((void*)PS_STRINGS, &pstr, sizeof(pstr));
+		if (error)
+			return (error);
+		for (i = 0; i < pstr.ps_nargvstr; i++) {
+			sbuf_copyin(sb, pstr.ps_argvstr[i], 0);
+			sbuf_printf(sb, "%c", '\0');
 		}
 	}