upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 08:12:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

vfs cache: plug a hypothetical corner case when freeing

Browse source 
cache_zap_unlocked_bucket is called with a bunch of addresses and
without any locks held, forcing it to revalidate everything from
scratch.

It did not account for a case where the entry is reallocated with
everything the same except for the target vnode.

Should the target use a different lock than the one expected, freeing
would proceed without being properly synchronized.

Note this is almost impossible to happen in practice.

(cherry picked from commit 0f15054f79)
This commit is contained in:
Mateusz Guzik 2023-09-23 02:04:06 +00:00
parent 75b03f73b4
commit b206bfb92c
1 changed files with 18 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
sys/kern/vfs_cache.c
View file

@ -1645,6 +1645,7 @@ cache_zap_unlocked_bucket(struct namecache *ncp, struct componentname *cnp,
struct mtx *blp)
{
struct namecache *rncp;
struct mtx *rvlp;
cache_assert_bucket_unlocked(ncp);
@ -1657,14 +1658,24 @@ cache_zap_unlocked_bucket(struct namecache *ncp, struct componentname *cnp,
!bcmp(rncp->nc_name, cnp->cn_nameptr, rncp->nc_nlen))
break;
}
if (rncp != NULL) {
cache_zap_locked(rncp);
mtx_unlock(blp);
cache_unlock_vnodes(dvlp, vlp);
atomic_add_long(&zap_bucket_relock_success, 1);
return (0);
}
if (rncp == NULL)
goto out_mismatch;
if (!(ncp->nc_flag & NCF_NEGATIVE))
rvlp = VP2VNODELOCK(rncp->nc_vp);
else
rvlp = NULL;
if (rvlp != vlp)
goto out_mismatch;
cache_zap_locked(rncp);
mtx_unlock(blp);
cache_unlock_vnodes(dvlp, vlp);
atomic_add_long(&zap_bucket_relock_success, 1);
return (0);
out_mismatch:
mtx_unlock(blp);
cache_unlock_vnodes(dvlp, vlp);
return (EAGAIN);