CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/13 09:23:27
Modified files:
sys/kern : spec_vnops.c vfs_lockf.c vfs_subr.c
sys/sys : lockf.h
Log message:
sys: protect special device locks during vnode teardown
Special device advisory locking can race with vnode teardown and access
freed specinfo.
OpenAI reported the problem and supplied an initial patch; that patch
introduced a NULL dereference window by clearing v_specinfo while
leaving the vnode typed VCHR or VBLK across a sleep; it also left
teardown exposed to vnode recycling during the drain.
In other words the initial patch addressed one race, introduced another,
and left the vnode lifetime problem unfixed.
Here the reworked approach with large colaboration with claudio@ with
talks and inputs from deraadt@ and beck@.
Resolve and detach specinfo under lockf_lock, interrupt all pending
requests, and retain its storage until the drain completes. Keep VXLOCK
and the temporary vnode reference through teardown; set VBAD before
detaching specinfo and exclude VXLOCK vnodes from recycling.
OK: claudio@
