Bug Summary

File:kern/kern_exec.c
Warning:line 865, column 8
Although the value stored to 'r' is used in the enclosing expression, the value is never actually read from 'r'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name kern_exec.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/kern/kern_exec.c
1/* $OpenBSD: kern_exec.c,v 1.252 2023/10/30 07:13:10 claudio Exp $ */
2/* $NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $ */
3
4/*-
5 * Copyright (C) 1993, 1994 Christopher G. Demetriou
6 * Copyright (C) 1992 Wolfgang Solfrank.
7 * Copyright (C) 1992 TooLs GmbH.
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * This product includes software developed by TooLs GmbH.
21 * 4. The name of TooLs GmbH may not be used to endorse or promote products
22 * derived from this software without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
25 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27 * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
30 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
32 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
33 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36#include <sys/param.h>
37#include <sys/systm.h>
38#include <sys/filedesc.h>
39#include <sys/proc.h>
40#include <sys/user.h>
41#include <sys/mount.h>
42#include <sys/malloc.h>
43#include <sys/pool.h>
44#include <sys/namei.h>
45#include <sys/vnode.h>
46#include <sys/fcntl.h>
47#include <sys/file.h>
48#include <sys/acct.h>
49#include <sys/exec.h>
50#include <sys/exec_elf.h>
51#include <sys/ktrace.h>
52#include <sys/resourcevar.h>
53#include <sys/mman.h>
54#include <sys/signalvar.h>
55#include <sys/stat.h>
56#include <sys/conf.h>
57#include <sys/pledge.h>
58#ifdef SYSVSHM1
59#include <sys/shm.h>
60#endif
61
62#include <sys/syscallargs.h>
63
64#include <uvm/uvm_extern.h>
65#include <machine/tcb.h>
66
67#include <sys/timetc.h>
68
69struct uvm_object *sigobject; /* shared sigcode object */
70vaddr_t sigcode_va;
71vsize_t sigcode_sz;
72struct uvm_object *timekeep_object;
73struct timekeep *timekeep;
74
75void unveil_destroy(struct process *ps);
76
77const struct kmem_va_mode kv_exec = {
78 .kv_wait = 1,
79 .kv_map = &exec_map
80};
81
82/*
83 * Map the shared signal code.
84 */
85int exec_sigcode_map(struct process *);
86
87/*
88 * Map the shared timekeep page.
89 */
90int exec_timekeep_map(struct process *);
91
92/*
93 * If non-zero, stackgap_random specifies the upper limit of the random gap size
94 * added to the fixed stack position. Must be n^2.
95 */
96int stackgap_random = STACKGAP_RANDOM256*1024;
97
98/*
99 * check exec:
100 * given an "executable" described in the exec package's namei info,
101 * see what we can do with it.
102 *
103 * ON ENTRY:
104 * exec package with appropriate namei info
105 * proc pointer of exec'ing proc
106 * NO SELF-LOCKED VNODES
107 *
108 * ON EXIT:
109 * error: nothing held, etc. exec header still allocated.
110 * ok: filled exec package, one locked vnode.
111 *
112 * EXEC SWITCH ENTRY:
113 * Locked vnode to check, exec package, proc.
114 *
115 * EXEC SWITCH EXIT:
116 * ok: return 0, filled exec package, one locked vnode.
117 * error: destructive:
118 * everything deallocated except exec header.
119 * non-destructive:
120 * error code, locked vnode, exec header unmodified
121 */
122int
123check_exec(struct proc *p, struct exec_package *epp)
124{
125 int error, i;
126 struct vnode *vp;
127 struct nameidata *ndp;
128 size_t resid;
129
130 ndp = epp->ep_ndp;
131 ndp->ni_cnd.cn_nameiop = LOOKUP0;
132 ndp->ni_cnd.cn_flags = FOLLOW0x0040 | LOCKLEAF0x0004 | SAVENAME0x000800;
133 if (epp->ep_flags & EXEC_INDIR0x0001)
134 ndp->ni_cnd.cn_flags |= BYPASSUNVEIL0x400000;
135 /* first get the vnode */
136 if ((error = namei(ndp)) != 0)
137 return (error);
138 epp->ep_vp = vp = ndp->ni_vp;
139
140 /* check for regular file */
141 if (vp->v_type != VREG) {
142 error = EACCES13;
143 goto bad1;
144 }
145
146 /* get attributes */
147 if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, p)) != 0)
148 goto bad1;
149
150 /* Check mount point */
151 if (vp->v_mount->mnt_flag & MNT_NOEXEC0x00000004) {
152 error = EACCES13;
153 goto bad1;
154 }
155
156 /* SUID programs may not be started with execpromises */
157 if ((epp->ep_vap->va_mode & (VSUID04000 | VSGID02000)) &&
158 (p->p_p->ps_flags & PS_EXECPLEDGE0x00400000)) {
159 error = EACCES13;
160 goto bad1;
161 }
162
163 if ((vp->v_mount->mnt_flag & MNT_NOSUID0x00000008))
164 epp->ep_vap->va_mode &= ~(VSUID04000 | VSGID02000);
165
166 /* check access. for root we have to see if any exec bit on */
167 if ((error = VOP_ACCESS(vp, VEXEC00100, p->p_ucred, p)) != 0)
168 goto bad1;
169 if ((epp->ep_vap->va_mode & (S_IXUSR0000100 | S_IXGRP0000010 | S_IXOTH0000001)) == 0) {
170 error = EACCES13;
171 goto bad1;
172 }
173
174 /* try to open it */
175 if ((error = VOP_OPEN(vp, FREAD0x0001, p->p_ucred, p)) != 0)
176 goto bad1;
177
178 /* unlock vp, we need it unlocked from here */
179 VOP_UNLOCK(vp);
180
181 /* now we have the file, get the exec header */
182 error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
183 UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
184 if (error)
185 goto bad2;
186 epp->ep_hdrvalid = epp->ep_hdrlen - resid;
187
188 /*
189 * set up the vmcmds for creation of the process
190 * address space
191 */
192 error = ENOEXEC8;
193 for (i = 0; i < nexecs && error != 0; i++) {
194 int newerror;
195
196 if (execsw[i].es_check == NULL((void *)0))
197 continue;
198 newerror = (*execsw[i].es_check)(p, epp);
199 /* make sure the first "interesting" error code is saved. */
200 if (!newerror || error == ENOEXEC8)
201 error = newerror;
202 if (epp->ep_flags & EXEC_DESTR0x0010 && error != 0)
203 return (error);
204 }
205 if (!error) {
206 /* check that entry point is sane */
207 if (epp->ep_entry > VM_MAXUSER_ADDRESS0x00007f7fffffc000) {
208 error = ENOEXEC8;
209 }
210
211 /* check limits */
212 if ((epp->ep_tsize > MAXTSIZ((paddr_t)256*1024*1024)) ||
213 (epp->ep_dsize > lim_cur(RLIMIT_DATA2)))
214 error = ENOMEM12;
215
216 if (!error)
217 return (0);
218 }
219
220 /*
221 * free any vmspace-creation commands,
222 * and release their references
223 */
224 kill_vmcmds(&epp->ep_vmcmds);
225
226bad2:
227 /*
228 * close the vnode, free the pathname buf, and punt.
229 */
230 vn_close(vp, FREAD0x0001, p->p_ucred, p);
231 pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
232 return (error);
233
234bad1:
235 /*
236 * free the namei pathname buffer, and put the vnode
237 * (which we don't yet have open).
238 */
239 pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
240 vput(vp);
241 return (error);
242}
243
244/*
245 * exec system call
246 */
247int
248sys_execve(struct proc *p, void *v, register_t *retval)
249{
250 struct sys_execve_args /* {
251 syscallarg(const char *) path;
252 syscallarg(char *const *) argp;
253 syscallarg(char *const *) envp;
254 } */ *uap = v;
255 int error;
256 struct exec_package pack;
257 struct nameidata nid;
258 struct vattr attr;
259 struct ucred *cred = p->p_ucred;
260 char *argp;
261 char * const *cpp, *dp, *sp;
262#ifdef KTRACE1
263 char *env_start;
264#endif
265 struct process *pr = p->p_p;
266 long argc, envc;
267 size_t len, sgap, dstsize;
268#ifdef MACHINE_STACK_GROWS_UP
269 size_t slen;
270#endif
271 vaddr_t pc = PROC_PC(p)((p)->p_md.md_regs->tf_rip);
272 char *stack;
273 struct ps_strings arginfo;
274 struct vmspace *vm = p->p_vmspace;
275 struct vnode *otvp;
276
277 if (vm->vm_execve &&
278 (pc >= vm->vm_execve_end || pc < vm->vm_execve)) {
279 printf("%s(%d): execve %lx outside %lx-%lx\n", pr->ps_comm,
280 pr->ps_pid, pc, vm->vm_execve, vm->vm_execve_end);
281 p->p_p->ps_acflag |= AEXECVE0x00000100;
282 sigabort(p);
283 return (0);
284 }
285
286 /*
287 * Get other threads to stop, if contested return ERESTART,
288 * so the syscall is restarted after halting in userret.
289 */
290 if (single_thread_set(p, SINGLE_UNWIND0x02 | SINGLE_DEEP0x10))
291 return (ERESTART-1);
292
293 /*
294 * Cheap solution to complicated problems.
295 * Mark this process as "leave me alone, I'm execing".
296 */
297 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
298
299 NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), p)ndinitat(&nid, 0, 0x0000, UIO_USERSPACE, -100, ((uap)->
path.le.datum), p);
300 nid.ni_pledge = PLEDGE_EXEC0x0000000000080000ULL;
301 nid.ni_unveil = UNVEIL_EXEC0x08;
302
303 /*
304 * initialize the fields of the exec package.
305 */
306 pack.ep_name = (char *)SCARG(uap, path)((uap)->path.le.datum);
307 pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC63, M_WAITOK0x0001);
308 pack.ep_hdrlen = exec_maxhdrsz;
309 pack.ep_hdrvalid = 0;
310 pack.ep_ndp = &nid;
311 pack.ep_interp = NULL((void *)0);
312 pack.ep_args = NULL((void *)0);
313 pack.ep_auxinfo = NULL((void *)0);
314 VMCMDSET_INIT(&pack.ep_vmcmds)do { (&pack.ep_vmcmds)->evs_cnt = 12; (&pack.ep_vmcmds
)->evs_cmds = (&pack.ep_vmcmds)->evs_start; (&pack
.ep_vmcmds)->evs_used = 0; } while (0);
315 pack.ep_vap = &attr;
316 pack.ep_flags = 0;
317
318 /* see if we can run it. */
319 if ((error = check_exec(p, &pack)) != 0) {
320 goto freehdr;
321 }
322
323 /* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
324
325 /* allocate an argument buffer */
326 argp = km_alloc(NCARGS(512 * 1024), &kv_exec, &kp_pageable, &kd_waitok);
327#ifdef DIAGNOSTIC1
328 if (argp == NULL((void *)0))
329 panic("execve: argp == NULL");
330#endif
331 dp = argp;
332 argc = 0;
333
334 /*
335 * Copy the fake args list, if there's one, freeing it as we go.
336 * exec_script_makecmds() allocates either 2 or 3 fake args bounded
337 * by MAXINTERP + MAXPATHLEN < NCARGS so no overflow can happen.
338 */
339 if (pack.ep_flags & EXEC_HASARGL0x0004) {
340 dstsize = NCARGS(512 * 1024);
341 for(; pack.ep_fa[argc] != NULL((void *)0); argc++) {
342 len = strlcpy(dp, pack.ep_fa[argc], dstsize);
343 len++;
344 dp += len; dstsize -= len;
345 if (pack.ep_fa[argc+1] != NULL((void *)0))
346 free(pack.ep_fa[argc], M_EXEC63, len);
347 else
348 free(pack.ep_fa[argc], M_EXEC63, MAXPATHLEN1024);
349 }
350 free(pack.ep_fa, M_EXEC63, 4 * sizeof(char *));
351 pack.ep_flags &= ~EXEC_HASARGL0x0004;
352 }
353
354 /* Now get argv & environment */
355 if (!(cpp = SCARG(uap, argp)((uap)->argp.le.datum))) {
356 error = EFAULT14;
357 goto bad;
358 }
359
360 if (pack.ep_flags & EXEC_SKIPARG0x0008)
361 cpp++;
362
363 while (1) {
364 len = argp + ARG_MAX(512 * 1024) - dp;
365 if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
366 goto bad;
367 if (!sp)
368 break;
369 if ((error = copyinstr(sp, dp, len, &len)) != 0) {
370 if (error == ENAMETOOLONG63)
371 error = E2BIG7;
372 goto bad;
373 }
374 dp += len;
375 cpp++;
376 argc++;
377 }
378
379 /* must have at least one argument */
380 if (argc == 0) {
381 error = EINVAL22;
382 goto bad;
383 }
384
385#ifdef KTRACE1
386 if (KTRPOINT(p, KTR_EXECARGS)((p)->p_p->ps_traceflag & (1<<(10)) &&
((p)->p_flag & 0x00000001) == 0))
387 ktrexec(p, KTR_EXECARGS10, argp, dp - argp);
388#endif
389
390 envc = 0;
391 /* environment does not need to be there */
392 if ((cpp = SCARG(uap, envp)((uap)->envp.le.datum)) != NULL((void *)0) ) {
393#ifdef KTRACE1
394 env_start = dp;
395#endif
396 while (1) {
397 len = argp + ARG_MAX(512 * 1024) - dp;
398 if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
399 goto bad;
400 if (!sp)
401 break;
402 if ((error = copyinstr(sp, dp, len, &len)) != 0) {
403 if (error == ENAMETOOLONG63)
404 error = E2BIG7;
405 goto bad;
406 }
407 dp += len;
408 cpp++;
409 envc++;
410 }
411
412#ifdef KTRACE1
413 if (KTRPOINT(p, KTR_EXECENV)((p)->p_p->ps_traceflag & (1<<(11)) &&
((p)->p_flag & 0x00000001) == 0))
414 ktrexec(p, KTR_EXECENV11, env_start, dp - env_start);
415#endif
416 }
417
418 dp = (char *)(((long)dp + _STACKALIGNBYTES15) & ~_STACKALIGNBYTES15);
419
420 /*
421 * If we have enabled random stackgap, the stack itself has already
422 * been moved from a random location, but is still aligned to a page
423 * boundary. Provide the lower bits of random placement now.
424 */
425 if (stackgap_random == 0) {
426 sgap = 0;
427 } else {
428 sgap = arc4random() & PAGE_MASK((1 << 12) - 1);
429 sgap = (sgap + _STACKALIGNBYTES15) & ~_STACKALIGNBYTES15;
430 }
431
432 /* Now check if args & environ fit into new stack */
433 len = ((argc + envc + 2 + ELF_AUX_WORDS(sizeof(Aux64Info) * 9 / sizeof(char *))) * sizeof(char *) +
434 sizeof(long) + dp + sgap + sizeof(struct ps_strings)) - argp;
435
436 len = (len + _STACKALIGNBYTES15) &~ _STACKALIGNBYTES15;
437
438 if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
439 error = ENOMEM12;
440 goto bad;
441 }
442
443 /* adjust "active stack depth" for process VSZ */
444 pack.ep_ssize = len; /* maybe should go elsewhere, but... */
445
446 /*
447 * we're committed: any further errors will kill the process, so
448 * kill the other threads now.
449 */
450 single_thread_set(p, SINGLE_EXIT0x03);
451
452 /*
453 * Prepare vmspace for remapping. Note that uvmspace_exec can replace
454 * ps_vmspace!
455 */
456 uvmspace_exec(p, VM_MIN_ADDRESS(1 << 12), VM_MAXUSER_ADDRESS0x00007f7fffffc000);
457
458 vm = pr->ps_vmspace;
459 /* Now map address space */
460 vm->vm_taddr = (char *)trunc_page(pack.ep_taddr)((pack.ep_taddr) & ~((1 << 12) - 1));
461 vm->vm_tsize = atop(round_page(pack.ep_taddr + pack.ep_tsize) -(((((pack.ep_taddr + pack.ep_tsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_taddr) & ~((1 <<
12) - 1))) >> 12)
462 trunc_page(pack.ep_taddr))(((((pack.ep_taddr + pack.ep_tsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_taddr) & ~((1 <<
12) - 1))) >> 12);
463 vm->vm_daddr = (char *)trunc_page(pack.ep_daddr)((pack.ep_daddr) & ~((1 << 12) - 1));
464 vm->vm_dsize = atop(round_page(pack.ep_daddr + pack.ep_dsize) -(((((pack.ep_daddr + pack.ep_dsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_daddr) & ~((1 <<
12) - 1))) >> 12)
465 trunc_page(pack.ep_daddr))(((((pack.ep_daddr + pack.ep_dsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_daddr) & ~((1 <<
12) - 1))) >> 12);
466 vm->vm_dused = 0;
467 vm->vm_ssize = atop(round_page(pack.ep_ssize))(((((pack.ep_ssize) + ((1 << 12) - 1)) & ~((1 <<
12) - 1))) >> 12);
468 vm->vm_maxsaddr = (char *)pack.ep_maxsaddr;
469 vm->vm_minsaddr = (char *)pack.ep_minsaddr;
470
471 /* create the new process's VM space by running the vmcmds */
472#ifdef DIAGNOSTIC1
473 if (pack.ep_vmcmds.evs_used == 0)
474 panic("execve: no vmcmds");
475#endif
476 error = exec_process_vmcmds(p, &pack);
477
478 /* if an error happened, deallocate and punt */
479 if (error)
480 goto exec_abort;
481
482#ifdef MACHINE_STACK_GROWS_UP
483 pr->ps_strings = (vaddr_t)vm->vm_maxsaddr + sgap;
484 if (uvm_map_protect(&vm->vm_map, (vaddr_t)vm->vm_maxsaddr,
485 trunc_page(pr->ps_strings)((pr->ps_strings) & ~((1 << 12) - 1)), PROT_NONE0x00, 0, TRUE1, FALSE0))
486 goto exec_abort;
487#else
488 pr->ps_strings = (vaddr_t)vm->vm_minsaddr - sizeof(arginfo) - sgap;
489 if (uvm_map_protect(&vm->vm_map,
490 round_page(pr->ps_strings + sizeof(arginfo))(((pr->ps_strings + sizeof(arginfo)) + ((1 << 12) - 1
)) & ~((1 << 12) - 1)),
491 (vaddr_t)vm->vm_minsaddr, PROT_NONE0x00, 0, TRUE1, FALSE0))
492 goto exec_abort;
493#endif
494
495 memset(&arginfo, 0, sizeof(arginfo))__builtin_memset((&arginfo), (0), (sizeof(arginfo)));
496
497 /* remember information about the process */
498 arginfo.ps_nargvstr = argc;
499 arginfo.ps_nenvstr = envc;
500
501#ifdef MACHINE_STACK_GROWS_UP
502 stack = (char *)vm->vm_maxsaddr + sizeof(arginfo) + sgap;
503 slen = len - sizeof(arginfo) - sgap;
504#else
505 stack = (char *)(vm->vm_minsaddr - len);
506#endif
507 /* Now copy argc, args & environ to new stack */
508 if (!copyargs(&pack, &arginfo, stack, argp))
509 goto exec_abort;
510
511 pr->ps_auxinfo = (vaddr_t)pack.ep_auxinfo;
512
513 /* copy out the process's ps_strings structure */
514 if (copyout(&arginfo, (char *)pr->ps_strings, sizeof(arginfo)))
515 goto exec_abort;
516
517 stopprofclock(pr); /* stop profiling */
518 fdcloseexec(p); /* handle close on exec */
519 execsigs(p); /* reset caught signals */
520 TCB_SET(p, NULL)tcb_set(p, ((void *)0)); /* reset the TCB address */
521 pr->ps_kbind_addr = 0; /* reset the kbind bits */
522 pr->ps_kbind_cookie = 0;
523 arc4random_buf(&pr->ps_sigcookie, sizeof pr->ps_sigcookie);
524
525 /* set command name & other accounting info */
526 memset(pr->ps_comm, 0, sizeof(pr->ps_comm))__builtin_memset((pr->ps_comm), (0), (sizeof(pr->ps_comm
)));
527 strlcpy(pr->ps_comm, nid.ni_cnd.cn_nameptr, sizeof(pr->ps_comm));
528 pr->ps_acflag &= ~AFORK0x00000001;
529
530 /* record proc's vnode, for use by sysctl */
531 otvp = pr->ps_textvp;
532 vref(pack.ep_vp);
533 pr->ps_textvp = pack.ep_vp;
534 if (otvp)
535 vrele(otvp);
536
537 if (pack.ep_flags & EXEC_NOBTCFI0x0040)
538 atomic_setbits_intx86_atomic_setbits_u32(&p->p_p->ps_flags, PS_NOBTCFI0x02000000);
539 else
540 atomic_clearbits_intx86_atomic_clearbits_u32(&p->p_p->ps_flags, PS_NOBTCFI0x02000000);
541
542 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_EXEC0x00000002);
543 if (pr->ps_flags & PS_PPWAIT0x00000040) {
544 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_PPWAIT0x00000040);
545 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_pptr->ps_flags, PS_ISPWAIT0x00000080);
546 wakeup(pr->ps_pptr);
547 }
548
549 /*
550 * If process does execve() while it has a mismatched real,
551 * effective, or saved uid/gid, we set PS_SUGIDEXEC.
552 */
553 if (cred->cr_uid != cred->cr_ruid ||
554 cred->cr_uid != cred->cr_svuid ||
555 cred->cr_gid != cred->cr_rgid ||
556 cred->cr_gid != cred->cr_svgid)
557 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_SUGIDEXEC0x00000020);
558 else
559 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_SUGIDEXEC0x00000020);
560
561 if (pr->ps_flags & PS_EXECPLEDGE0x00400000) {
562 pr->ps_pledge = pr->ps_execpledge;
563 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_PLEDGE0x00100000);
564 } else {
565 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_PLEDGE0x00100000);
566 pr->ps_pledge = 0;
567 /* XXX XXX XXX XXX */
568 /* Clear our unveil paths out so the child
569 * starts afresh
570 */
571 unveil_destroy(pr);
572 pr->ps_uvdone = 0;
573 }
574
575 /*
576 * deal with set[ug]id.
577 * MNT_NOEXEC has already been used to disable s[ug]id.
578 */
579 if ((attr.va_mode & (VSUID04000 | VSGID02000)) && proc_cansugid(p)) {
580 int i;
581
582 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_SUGID0x00000010|PS_SUGIDEXEC0x00000020);
583
584#ifdef KTRACE1
585 /*
586 * If process is being ktraced, turn off - unless
587 * root set it.
588 */
589 if (pr->ps_tracevp && !(pr->ps_traceflag & KTRFAC_ROOT0x80000000U))
590 ktrcleartrace(pr);
591#endif
592 p->p_ucred = cred = crcopy(cred);
593 if (attr.va_mode & VSUID04000)
594 cred->cr_uid = attr.va_uid;
595 if (attr.va_mode & VSGID02000)
596 cred->cr_gid = attr.va_gid;
597
598 /*
599 * For set[ug]id processes, a few caveats apply to
600 * stdin, stdout, and stderr.
601 */
602 error = 0;
603 fdplock(p->p_fd)do { do { int _s = rw_status(&netlock); if ((splassert_ctl
> 0) && (_s == 0x0001UL)) splassert_fail(0, 0x0001UL
, __func__); } while (0); rw_enter_write(&(p->p_fd)->
fd_lock); } while (0);
604 for (i = 0; i < 3; i++) {
605 struct file *fp = NULL((void *)0);
606
607 /*
608 * NOTE - This will never return NULL because of
609 * immature fds. The file descriptor table is not
610 * shared because we're suid.
611 */
612 fp = fd_getfile(p->p_fd, i);
613
614 /*
615 * Ensure that stdin, stdout, and stderr are already
616 * allocated. We do not want userland to accidentally
617 * allocate descriptors in this range which has implied
618 * meaning to libc.
619 */
620 if (fp == NULL((void *)0)) {
621 short flags = FREAD0x0001 | (i == 0 ? 0 : FWRITE0x0002);
622 struct vnode *vp;
623 int indx;
624
625 if ((error = falloc(p, &fp, &indx)) != 0)
626 break;
627#ifdef DIAGNOSTIC1
628 if (indx != i)
629 panic("sys_execve: falloc indx != i");
630#endif
631 if ((error = cdevvp(getnulldev(), &vp)) != 0) {
632 fdremove(p->p_fd, indx);
633 closef(fp, p);
634 break;
635 }
636 if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
637 fdremove(p->p_fd, indx);
638 closef(fp, p);
639 vrele(vp);
640 break;
641 }
642 if (flags & FWRITE0x0002)
643 vp->v_writecount++;
644 fp->f_flag = flags;
645 fp->f_type = DTYPE_VNODE1;
646 fp->f_ops = &vnops;
647 fp->f_data = (caddr_t)vp;
648 fdinsert(p->p_fd, indx, 0, fp);
649 }
650 FRELE(fp, p)(_atomic_sub_int_nv((&fp->f_count), 1) == 0 ? fdrop(fp
, p) : 0);
651 }
652 fdpunlock(p->p_fd)rw_exit_write(&(p->p_fd)->fd_lock);
653 if (error)
654 goto exec_abort;
655 } else
656 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_SUGID0x00000010);
657
658 /*
659 * Reset the saved ugids and update the process's copy of the
660 * creds if the creds have been changed
661 */
662 if (cred->cr_uid != cred->cr_svuid ||
663 cred->cr_gid != cred->cr_svgid) {
664 /* make sure we have unshared ucreds */
665 p->p_ucred = cred = crcopy(cred);
666 cred->cr_svuid = cred->cr_uid;
667 cred->cr_svgid = cred->cr_gid;
668 }
669
670 if (pr->ps_ucred != cred) {
671 struct ucred *ocred;
672
673 ocred = pr->ps_ucred;
674 crhold(cred);
675 pr->ps_ucred = cred;
676 crfree(ocred);
677 }
678
679 if (pr->ps_flags & PS_SUGIDEXEC0x00000020) {
680 cancel_all_itimers();
681 }
682
683 /* reset CPU time usage for the thread, but not the process */
684 timespecclear(&p->p_tu.tu_runtime)(&p->p_tu.tu_runtime)->tv_sec = (&p->p_tu.tu_runtime
)->tv_nsec = 0;
685 p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
686
687 memset(p->p_name, 0, sizeof p->p_name)__builtin_memset((p->p_name), (0), (sizeof p->p_name));
688
689 km_free(argp, NCARGS(512 * 1024), &kv_exec, &kp_pageable);
690
691 pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
692 vn_close(pack.ep_vp, FREAD0x0001, cred, p);
693
694 /*
695 * notify others that we exec'd
696 */
697 knote_locked(&pr->ps_klist, NOTE_EXEC0x20000000);
698
699 /* map the process's timekeep page, needs to be before exec_elf_fixup */
700 if (exec_timekeep_map(pr))
701 goto free_pack_abort;
702
703 /* setup new registers and do misc. setup. */
704 if (exec_elf_fixup(p, &pack) != 0)
705 goto free_pack_abort;
706#ifdef MACHINE_STACK_GROWS_UP
707 setregs(p, &pack, (u_long)stack + slen, &arginfo);
708#else
709 setregs(p, &pack, (u_long)stack, &arginfo);
710#endif
711
712 /* map the process's signal trampoline code */
713 if (exec_sigcode_map(pr))
714 goto free_pack_abort;
715
716#ifdef __HAVE_EXEC_MD_MAP
717 /* perform md specific mappings that process might need */
718 if (exec_md_map(p, &pack))
719 goto free_pack_abort;
720#endif
721
722 if (pr->ps_flags & PS_TRACED0x00000200)
723 psignal(p, SIGTRAP5);
724
725 free(pack.ep_hdr, M_EXEC63, pack.ep_hdrlen);
726
727 p->p_descfd = 255;
728 if ((pack.ep_flags & EXEC_HASFD0x0002) && pack.ep_fd < 255)
729 p->p_descfd = pack.ep_fd;
730
731 if (pack.ep_flags & EXEC_WXNEEDED0x0020)
732 atomic_setbits_intx86_atomic_setbits_u32(&p->p_p->ps_flags, PS_WXNEEDED0x00200000);
733 else
734 atomic_clearbits_intx86_atomic_clearbits_u32(&p->p_p->ps_flags, PS_WXNEEDED0x00200000);
735
736 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
737 single_thread_clear(p, P_SUSPSIG0x08000000);
738
739 /* setregs() sets up all the registers, so just 'return' */
740 return EJUSTRETURN-2;
741
742bad:
743 /* free the vmspace-creation commands, and release their references */
744 kill_vmcmds(&pack.ep_vmcmds);
745 /* kill any opened file descriptor, if necessary */
746 if (pack.ep_flags & EXEC_HASFD0x0002) {
747 pack.ep_flags &= ~EXEC_HASFD0x0002;
748 fdplock(p->p_fd)do { do { int _s = rw_status(&netlock); if ((splassert_ctl
> 0) && (_s == 0x0001UL)) splassert_fail(0, 0x0001UL
, __func__); } while (0); rw_enter_write(&(p->p_fd)->
fd_lock); } while (0);
749 /* fdrelease unlocks p->p_fd. */
750 (void) fdrelease(p, pack.ep_fd);
751 }
752 if (pack.ep_interp != NULL((void *)0))
753 pool_put(&namei_pool, pack.ep_interp);
754 free(pack.ep_args, M_TEMP127, sizeof *pack.ep_args);
755 /* close and put the exec'd file */
756 vn_close(pack.ep_vp, FREAD0x0001, cred, p);
757 pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
758 km_free(argp, NCARGS(512 * 1024), &kv_exec, &kp_pageable);
759
760freehdr:
761 free(pack.ep_hdr, M_EXEC63, pack.ep_hdrlen);
762 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
763 single_thread_clear(p, P_SUSPSIG0x08000000);
764
765 return (error);
766
767exec_abort:
768 /*
769 * the old process doesn't exist anymore. exit gracefully.
770 * get rid of the (new) address space we have created, if any, get rid
771 * of our namei data and vnode, and exit noting failure
772 */
773 uvm_unmap(&vm->vm_map, VM_MIN_ADDRESS(1 << 12), VM_MAXUSER_ADDRESS0x00007f7fffffc000);
774 if (pack.ep_interp != NULL((void *)0))
775 pool_put(&namei_pool, pack.ep_interp);
776 free(pack.ep_args, M_TEMP127, sizeof *pack.ep_args);
777 pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
778 vn_close(pack.ep_vp, FREAD0x0001, cred, p);
779 km_free(argp, NCARGS(512 * 1024), &kv_exec, &kp_pageable);
780
781free_pack_abort:
782 free(pack.ep_hdr, M_EXEC63, pack.ep_hdrlen);
783 exit1(p, 0, SIGABRT6, EXIT_NORMAL0x00000001);
784
785 /* NOTREACHED */
786 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
787
788 return (0);
789}
790
791
792int
793copyargs(struct exec_package *pack, struct ps_strings *arginfo, void *stack,
794 void *argp)
795{
796 char **cpp = stack;
797 char *dp, *sp;
798 size_t len;
799 void *nullp = NULL((void *)0);
800 long argc = arginfo->ps_nargvstr;
801 int envc = arginfo->ps_nenvstr;
802
803 if (copyout(&argc, cpp++, sizeof(argc)))
804 return (0);
805
806 dp = (char *) (cpp + argc + envc + 2 + ELF_AUX_WORDS(sizeof(Aux64Info) * 9 / sizeof(char *)));
807 sp = argp;
808
809 /* XXX don't copy them out, remap them! */
810 arginfo->ps_argvstr = cpp; /* remember location of argv for later */
811
812 for (; --argc >= 0; sp += len, dp += len)
813 if (copyout(&dp, cpp++, sizeof(dp)) ||
814 copyoutstr(sp, dp, ARG_MAX(512 * 1024), &len))
815 return (0);
816
817 if (copyout(&nullp, cpp++, sizeof(nullp)))
818 return (0);
819
820 arginfo->ps_envstr = cpp; /* remember location of envp for later */
821
822 for (; --envc >= 0; sp += len, dp += len)
823 if (copyout(&dp, cpp++, sizeof(dp)) ||
824 copyoutstr(sp, dp, ARG_MAX(512 * 1024), &len))
825 return (0);
826
827 if (copyout(&nullp, cpp++, sizeof(nullp)))
828 return (0);
829
830 /* if this process needs auxinfo, note where to place it */
831 if (pack->ep_args != NULL((void *)0))
832 pack->ep_auxinfo = cpp;
833
834 return (1);
835}
836
837int
838exec_sigcode_map(struct process *pr)
839{
840 extern char sigcode[], esigcode[], sigcoderet[];
841 vsize_t sz;
842
843 sz = (vaddr_t)esigcode - (vaddr_t)sigcode;
844
845 /*
846 * If we don't have a sigobject yet, create one.
847 *
848 * sigobject is an anonymous memory object (just like SYSV shared
849 * memory) that we keep a permanent reference to and that we map
850 * in all processes that need this sigcode. The creation is simple,
851 * we create an object, add a permanent reference to it, map it in
852 * kernel space, copy out the sigcode to it and unmap it. Then we map
853 * it with PROT_EXEC into the process just the way sys_mmap would map it.
854 */
855 if (sigobject == NULL((void *)0)) {
856 extern int sigfillsiz;
857 extern u_char sigfill[];
858 size_t off, left;
859 vaddr_t va;
860 int r;
861
862 sigobject = uao_create(sz, 0);
863 uao_reference(sigobject); /* permanent reference */
864
865 if ((r = uvm_map(kernel_map, &va, round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)), sigobject,
Although the value stored to 'r' is used in the enclosing expression, the value is never actually read from 'r'
866 0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0))
867 MAP_INHERIT_SHARE, MADV_RANDOM, 0)((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0))))) {
868 uao_detach(sigobject);
869 return (ENOMEM12);
870 }
871
872 for (off = 0, left = round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)); left != 0;
873 off += sigfillsiz) {
874 size_t chunk = ulmin(left, sigfillsiz);
875 memcpy((caddr_t)va + off, sigfill, chunk)__builtin_memcpy(((caddr_t)va + off), (sigfill), (chunk));
876 left -= chunk;
877 }
878 memcpy((caddr_t)va, sigcode, sz)__builtin_memcpy(((caddr_t)va), (sigcode), (sz));
879
880 (void) uvm_map_protect(kernel_map, va, round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)),
881 PROT_READ0x01, 0, FALSE0, FALSE0);
882 sigcode_va = va;
883 sigcode_sz = round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1));
884 }
885
886 pr->ps_sigcode = 0; /* no hint */
887 uao_reference(sigobject);
888 if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_sigcode, round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)),
889 sigobject, 0, 0, UVM_MAPFLAG(PROT_EXEC,((0x04) | ((0x01 | 0x02 | 0x04) << 8) | ((1) << 4
) | ((1) << 12) | (0x0080000 | 0x10000000))
890 PROT_READ | PROT_WRITE | PROT_EXEC, MAP_INHERIT_COPY,((0x04) | ((0x01 | 0x02 | 0x04) << 8) | ((1) << 4
) | ((1) << 12) | (0x0080000 | 0x10000000))
891 MADV_RANDOM, UVM_FLAG_COPYONW | UVM_FLAG_SYSCALL)((0x04) | ((0x01 | 0x02 | 0x04) << 8) | ((1) << 4
) | ((1) << 12) | (0x0080000 | 0x10000000)))) {
892 uao_detach(sigobject);
893 return (ENOMEM12);
894 }
895 uvm_map_immutable(&pr->ps_vmspace->vm_map, pr->ps_sigcode,
896 pr->ps_sigcode + round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)), 1);
897
898 /* Calculate PC at point of sigreturn entry */
899 pr->ps_sigcoderet = pr->ps_sigcode + (sigcoderet - sigcode);
900
901 return (0);
902}
903
904int
905exec_timekeep_map(struct process *pr)
906{
907 size_t timekeep_sz = round_page(sizeof(struct timekeep))(((sizeof(struct timekeep)) + ((1 << 12) - 1)) & ~(
(1 << 12) - 1));
908
909 /*
910 * Similar to the sigcode object
911 */
912 if (timekeep_object == NULL((void *)0)) {
913 vaddr_t va = 0;
914
915 timekeep_object = uao_create(timekeep_sz, 0);
916 uao_reference(timekeep_object);
917
918 if (uvm_map(kernel_map, &va, timekeep_sz, timekeep_object,
919 0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0))
920 MAP_INHERIT_SHARE, MADV_RANDOM, 0)((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0)))) {
921 uao_detach(timekeep_object);
922 timekeep_object = NULL((void *)0);
923 return (ENOMEM12);
924 }
925 if (uvm_fault_wire(kernel_map, va, va + timekeep_sz,
926 PROT_READ0x01 | PROT_WRITE0x02)) {
927 uvm_unmap(kernel_map, va, va + timekeep_sz);
928 uao_detach(timekeep_object);
929 timekeep_object = NULL((void *)0);
930 return (ENOMEM12);
931 }
932
933 timekeep = (struct timekeep *)va;
934 timekeep->tk_version = TK_VERSION0;
935 }
936
937 pr->ps_timekeep = 0; /* no hint */
938 uao_reference(timekeep_object);
939 if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_timekeep, timekeep_sz,
940 timekeep_object, 0, 0, UVM_MAPFLAG(PROT_READ, PROT_READ,((0x01) | ((0x01) << 8) | ((1) << 4) | ((1) <<
12) | (0))
941 MAP_INHERIT_COPY, MADV_RANDOM, 0)((0x01) | ((0x01) << 8) | ((1) << 4) | ((1) <<
12) | (0)))) {
942 uao_detach(timekeep_object);
943 return (ENOMEM12);
944 }
945 uvm_map_immutable(&pr->ps_vmspace->vm_map, pr->ps_timekeep,
946 pr->ps_timekeep + timekeep_sz, 1);
947
948 return (0);
949}