From nobody Tue Aug 4 22:37:01 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hF7hM4JbKz6nY6G for ; Tue, 04 Aug 2026 22:37:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hF7hM38vtz3sw3 for ; Tue, 04 Aug 2026 22:37:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785883027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mPLeM3peBdi4gbaVyQd3aRTKL1qQChsJRxYCcgcTaIo=; b=gxhCTfnZ2gOlsCXj38CBjK/s81gcrgHz2Ryx0RzXSrQIYRekgYQ27a/DxT1mC/8H+xpUfR 6Gv9ZlmBsD3WpQpWy+TT3f+zVc8EfMDOF0S2swEYjQ45PD/ehTu9BWoTjv6YYwLjo9B4pP Tj7OPjzBgrJWbHQZq1YqalAJbY+qVt+SUHC7LxYY8WjZsC5h6HnW0OccKAEd5QoMcQcSZ9 bEMWD6SaqQvajgoUwUq54Bq+4b0SfSsDTpCfVQkP/tC++HAgGtq/rZNwFjMZpSL6Z1wxED ix6IRti6BXbe0FoVOcEHBWNwGd/zRgZfOW1o/R1nkxvn3Qyyrtoe+3NRPcxVrQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785883027; a=rsa-sha256; cv=none; b=LM8YWCizXV6iUP+xp9WIUg2eJrXKNAJNgm2yWvI0zEEvSKLvz/EO6/0Its8M/y1BbwmQH5 /l7kYmy/fhuVeXxX8skFapy6Qiijvh1U5r12PxumCoaUo+J2Xem1PUQGiJwBTIEJNlDAAK vN+h9QRCnobAxHjmOIJNLbow8b9M47f5n+UfiF3/fRxkBH8re4QKtuMhz0+P4e0EJIv7tM aU/IL9KwNJ79LFRiWu0nCsJfV2f1vSCYkZQAM5YOTiqJV10ZvNU1LlZF27t6UkSaW9h73G dnKD7IKzTtMjSu4gdkOGdGCmamcWO1oS+Kvb2qf26Jb9ZOEU2QWO6G+CIkRqEQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785883027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mPLeM3peBdi4gbaVyQd3aRTKL1qQChsJRxYCcgcTaIo=; b=jVneVEZx0bCb1hgz7yY1YtWouv4Da9qlimItGQelL57JhcoMLATyg4pmPByJUZQplh9/sl wy8RHijDVULe8d5zQcTa4zsLWcIo9H9MTInVZCIipiTG9KMphEnY5EgNxq/zbAF6Q9WrCl bp4uEgUoqZW5ZsrKA9GwIM+NTTembeorLQzwyoGW8EH8l/N9U69tAINjcARX9Zwzdv67Xw KsyGdiy9R9MN0AaIMUuUUCrC5lJa6SFeop1wkaWmMUOZF9NqQXLw3X2aa1cbg53J435q/X KT6iMxzuO/pARMuvnbh0AaEpmMvUKNJU/qIph63akN2sWV/wEyUK1E98RsA8Fg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hF7hM0YVNz16Bx for ; Tue, 04 Aug 2026 22:37:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18ef6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 04 Aug 2026 22:37:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: b95a859483f1 - main - autofs_lookup(): busy the mount point around autofs_trigger() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b95a859483f1ac0671bde55c0a2fc46f4db5ba4b Auto-Submitted: auto-generated Date: Tue, 04 Aug 2026 22:37:01 +0000 Message-Id: <6a72698d.18ef6.5ed0ef8c@gitrepo.freebsd.org> The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=b95a859483f1ac0671bde55c0a2fc46f4db5ba4b commit b95a859483f1ac0671bde55c0a2fc46f4db5ba4b Author: Konstantin Belousov AuthorDate: 2026-08-03 17:41:46 +0000 Commit: Konstantin Belousov CommitDate: 2026-08-04 22:36:13 +0000 autofs_lookup(): busy the mount point around autofs_trigger() Since autofs_lookup() calls into autofs_trigger_vn() to perform automounting, and autofs_trigger_vn() unlocks the vnode, it is possible for the unmount to start meantime. Then autofs_trigger() accesses freed memory. At this point, busy can be only done unblocking, and the transient failure must abort the trigger operation. This would cause spurious automounter errors, but at least should prevent accesses to the freed memory. PR: 294361 Reviewed by: markj, rew Tested by: rew Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58626 --- sys/fs/autofs/autofs_vnops.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/sys/fs/autofs/autofs_vnops.c b/sys/fs/autofs/autofs_vnops.c index b6424fc2ff4c..2d1e1f77eda5 100644 --- a/sys/fs/autofs/autofs_vnops.c +++ b/sys/fs/autofs/autofs_vnops.c @@ -136,16 +136,22 @@ autofs_trigger_vn(struct vnode *vp, const char *path, int pathlen, struct vnode **newvp) { struct autofs_node *anp; + struct mount *mp; int error, lock_flags; anp = vp->v_data; /* - * Release the vnode lock, so that other operations, in partcular - * mounting a filesystem on top of it, can proceed. Increase use - * count, to prevent the vnode from being deallocated and to prevent - * filesystem from being unmounted. + * Release the vnode lock, so that other operations, in + * particular mounting a filesystem on top of it, can proceed. + * Increase use count and busy the mount, to prevent the vnode + * from being deallocated and to prevent filesystem from being + * unmounted. */ + mp = vp->v_mount; + error = vfs_busy(mp, MBF_NOWAIT); + if (error != 0) + return (error); lock_flags = VOP_ISLOCKED(vp); vref(vp); VOP_UNLOCK(vp); @@ -165,6 +171,7 @@ mounted: sx_xunlock(&autofs_softc->sc_lock); vn_lock(vp, lock_flags | LK_RETRY); vunref(vp); + vfs_unbusy(mp); if (VN_IS_DOOMED(vp)) { AUTOFS_DEBUG("VIRF_DOOMED"); return (ENOENT);