From 112c68649dac6d8414fb0d085587d569b3467a5a Mon Sep 17 00:00:00 2001
From: kib <kib@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Fri, 23 May 2014 09:29:04 +0000
Subject: [PATCH] MFC r266464: In execve(2), postpone the free of old vmspace
 until the threads are resumed and exited.

git-svn-id: svn://svn.freebsd.org/base/stable/10@266582 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 sys/kern/kern_exec.c | 9 +++++++++
 sys/sys/proc.h       | 1 +
 sys/vm/vm_map.c      | 4 +++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 7fdb680e3..15732fbe6 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -283,6 +283,7 @@ kern_execve(td, args, mac_p)
 	struct mac *mac_p;
 {
 	struct proc *p = td->td_proc;
+	struct vmspace *oldvmspace;
 	int error;
 
 	AUDIT_ARG_ARGV(args->begin_argv, args->argc,
@@ -299,6 +300,8 @@ kern_execve(td, args, mac_p)
 		PROC_UNLOCK(p);
 	}
 
+	KASSERT((td->td_pflags & TDP_EXECVMSPC) == 0, ("nested execve"));
+	oldvmspace = td->td_proc->p_vmspace;
 	error = do_execve(td, args, mac_p);
 
 	if (p->p_flag & P_HADTHREADS) {
@@ -313,6 +316,12 @@ kern_execve(td, args, mac_p)
 			thread_single_end();
 		PROC_UNLOCK(p);
 	}
+	if ((td->td_pflags & TDP_EXECVMSPC) != 0) {
+		KASSERT(td->td_proc->p_vmspace != oldvmspace,
+		    ("oldvmspace still used"));
+		vmspace_free(oldvmspace);
+		td->td_pflags &= ~TDP_EXECVMSPC;
+	}
 
 	return (error);
 }
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index e7cd022ae..29321141a 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -425,6 +425,7 @@ do {									\
 #define	TDP_NERRNO	0x08000000 /* Last errno is already in td_errno */
 #define	TDP_UIOHELD	0x10000000 /* Current uio has pages held in td_ma */
 #define	TDP_DEVMEMIO	0x20000000 /* Accessing memory for /dev/mem */
+#define	TDP_EXECVMSPC	0x40000000 /* Execve destroyed old vmspace */
 
 /*
  * Reasons that the current thread can not be run yet.
diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index cd070dfbd..3c0aabcac 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -3751,6 +3751,8 @@ vmspace_exec(struct proc *p, vm_offset_t minuser, vm_offset_t maxuser)
 	struct vmspace *oldvmspace = p->p_vmspace;
 	struct vmspace *newvmspace;
 
+	KASSERT((curthread->td_pflags & TDP_EXECVMSPC) == 0,
+	    ("vmspace_exec recursed"));
 	newvmspace = vmspace_alloc(minuser, maxuser, NULL);
 	if (newvmspace == NULL)
 		return (ENOMEM);
@@ -3767,7 +3769,7 @@ vmspace_exec(struct proc *p, vm_offset_t minuser, vm_offset_t maxuser)
 	PROC_VMSPACE_UNLOCK(p);
 	if (p == curthread->td_proc)
 		pmap_activate(curthread);
-	vmspace_free(oldvmspace);
+	curthread->td_pflags |= TDP_EXECVMSPC;
 	return (0);
 }
 
-- 
2.45.0