From nobody Wed Aug 5 15:16:44 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hFYsm65bbz6nQg1 for ; Wed, 05 Aug 2026 15:16:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hFYsm2Q1Nz3w7h for ; Wed, 05 Aug 2026 15:16:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785943004; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hVX+SaVuCbiMd7N/Ly8aIpH4XamASTB7FauDyYfX+3Q=; b=xxnC3C4dUAnNHKYimnCubTTD38h23qfDJOIiOtBQMc9xMVf6EeKTQW5/IDpGfheVcVo25M YKhiujTEhUrQkUHfBrk4yz62XHM/cAd6T7tnBRTQ2Ec44abLczslvwx/UHEgUoGXpg13zg OHBMVZCktAA3w/urfNv3lk92gXjH89cwVdF2IyJEA1xmsqwQRW6EJC+u0r7bl8oigh+uL0 zViJS+zrphQnbtyVGN2X/KYFudAzyYv7eMvHVTIPaO45P2eBLKtCEq40RlaqwACu0y2cC9 bXCWr5ueEsHFCcRaa0jOrCGzKE2OAL0NQ1TTSTUPBA6Xz/NbkSVWBVHONdgwLg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785943004; a=rsa-sha256; cv=none; b=d7CMrcQPTFRdFc8NoA1FwGeG1DYecMZ5LOgTKT2xjmioN/y75mvSdCD2xi1hU/8+Vd9w75 QPkwJgEyoWu78zKmrKp50TW70KfUMBd6kskEfmzwHkYodhSYvwSAsNzH1c7EB3VqDmXfKt LX5jz62dSaqzo3xjuPZWDv26I2LKSE5nkkZPKhfek/xQhzMMmoBSRdHhSktgMqZc96LclD AhfMmvtnVZ2Ap1i32hf+I6GXUGdGxmwx9fGTSZUIA0XEMXOLAKj/IbzuRxCxu5u5JlMHN2 /h9ZmjMiCVXP+7CG9UL+82qA7iG2J3MNQcMjBCdr+T0YYYvhK3ARv2qU13vPHw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785943004; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hVX+SaVuCbiMd7N/Ly8aIpH4XamASTB7FauDyYfX+3Q=; b=Tvt3C2Ep6ysDpEx+Kb7DOe9NlyOlYdi8INzI/QeA8Dq8cq2UJYuGYhpvP64Y4cMsTssvIu DG4A3TDUO76SbS0k51LzeHimX8m88R+oyOBPzvnOOd5lagqOY2MatTOUKrpl7c6yaEJ4oe OUiS8IIv/8K4S+Igs1dyU583Bm+zzS0i1fNJnMfBWuBtq0/oe1MzoVjawDzyel7rNreRQv VjEdN9Hhp8AA7yeEi6HioVwk5BhD/DOAnmr5H/6UdoSBAD/cmhY83BK73+OF9sYILbk17X Kh2sK6ptJ02Ix5qsnT1zu66j3lDPDaen6AjRZNkzMB9/iK8++Rj/redBFup6wA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hFYsm1VWszfYb for ; Wed, 05 Aug 2026 15:16:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e32 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 05 Aug 2026 15:16:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 9b094ba83a14 - stable/14 - inotify: Avoid calling vrele() with a namecache mutex held List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 9b094ba83a142b85bf4f9292f02749fc9fdb77cd Auto-Submitted: auto-generated Date: Wed, 05 Aug 2026 15:16:44 +0000 Message-Id: <6a7353dc.45e32.36fbebde@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9b094ba83a142b85bf4f9292f02749fc9fdb77cd commit 9b094ba83a142b85bf4f9292f02749fc9fdb77cd Author: Mark Johnston AuthorDate: 2025-08-01 18:16:17 +0000 Commit: Mark Johnston CommitDate: 2026-08-05 15:15:16 +0000 inotify: Avoid calling vrele() with a namecache mutex held In cache_vop_inotify(), we call inotify_log() with a namecache hash lock held. inotify_log() looks at all watches registered with the vnode to see if any of them are interested in the event. In some cases, we have to detach and free the watch after logging the event. This means we must vrele() the watched vnode, and this must not be done while a non-sleepable lock held. Previously, I deferred the vrele() to until the inotify softc and vnode pollinfo locks were dropped. However, this is not enough since we may still be holding the aforementioned namecache lock. Go further and use a taskqueue thread to release vnode references. Introduce a set of detached watches, and queue a threaded task which releases the vnode reference. Reported by: syzbot+c128f121cb22df95559b@syzkaller.appspotmail.com Reviewed by: kib Fixes: f1f230439fa4 ("vfs: Initial revision of inotify") Differential Revision: https://reviews.freebsd.org/D51685 (cherry picked from commit c2230ad3b121bd1e57fdb2c466f5b826aad5f730) --- sys/kern/vfs_inotify.c | 71 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 52 insertions(+), 19 deletions(-) diff --git a/sys/kern/vfs_inotify.c b/sys/kern/vfs_inotify.c index 035c2c9eb290..9ff15205c823 100644 --- a/sys/kern/vfs_inotify.c +++ b/sys/kern/vfs_inotify.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include #include @@ -166,6 +167,8 @@ struct inotify_softc { size_t nbpending; /* bytes available to read */ uint64_t ino; /* unique identifier */ struct inotify_watch_tree watches; /* active watches */ + TAILQ_HEAD(, inotify_watch) deadwatches; /* watches pending vrele() */ + struct task reaptask; /* task to reap dead watches */ struct selinfo sel; /* select/poll/kevent info */ struct ucred *cred; /* credential ref */ }; @@ -371,6 +374,13 @@ inotify_unlink_watch_locked(struct inotify_softc *sc, struct inotify_watch *watc vn_irflag_unset(vp, VIRF_INOTIFY); } +static void +inotify_free_watch(struct inotify_watch *watch) +{ + vrele(watch->vp); + free(watch, M_INOTIFY); +} + /* * Assumes that the watch has already been removed from its softc. */ @@ -386,9 +396,24 @@ inotify_remove_watch(struct inotify_watch *watch) mtx_lock(&vp->v_pollinfo->vpi_lock); inotify_unlink_watch_locked(sc, watch); mtx_unlock(&vp->v_pollinfo->vpi_lock); + inotify_free_watch(watch); +} - vrele(vp); - free(watch, M_INOTIFY); +static void +inotify_reap(void *arg, int pending) +{ + struct inotify_softc *sc; + struct inotify_watch *watch; + + sc = arg; + mtx_lock(&sc->lock); + while ((watch = TAILQ_FIRST(&sc->deadwatches)) != NULL) { + TAILQ_REMOVE(&sc->deadwatches, watch, vlink); + mtx_unlock(&sc->lock); + inotify_free_watch(watch); + mtx_lock(&sc->lock); + } + mtx_unlock(&sc->lock); } static int @@ -400,6 +425,7 @@ inotify_close(struct file *fp, struct thread *td) sc = fp->f_data; + /* Detach watches from their vnodes. */ mtx_lock(&sc->lock); (void)chginotifycnt(sc->cred->cr_ruidinfo, -1, 0); while ((watch = RB_MIN(inotify_watch_tree, &sc->watches)) != NULL) { @@ -408,6 +434,17 @@ inotify_close(struct file *fp, struct thread *td) inotify_remove_watch(watch); mtx_lock(&sc->lock); } + + /* Make sure that any asynchronous vrele() calls are done. */ + mtx_unlock(&sc->lock); + taskqueue_drain(taskqueue_thread, &sc->reaptask); + mtx_lock(&sc->lock); + KASSERT(RB_EMPTY(&sc->watches), + ("%s: watches not empty in %p", __func__, sc)); + KASSERT(TAILQ_EMPTY(&sc->deadwatches), + ("%s: deadwatches not empty in %p", __func__, sc)); + + /* Drop pending events. */ while (!STAILQ_EMPTY(&sc->pending)) { rec = inotify_dequeue(sc); if (rec != &sc->overflow) @@ -453,6 +490,8 @@ inotify_create_file(struct thread *td, struct file *fp, int flags, int *fflagsp) sc->nextwatch = 1; /* Required for compatibility. */ STAILQ_INIT(&sc->pending); RB_INIT(&sc->watches); + TAILQ_INIT(&sc->deadwatches); + TASK_INIT(&sc->reaptask, 0, inotify_reap, sc); mtx_init(&sc->lock, "inotify", NULL, MTX_DEF); knlist_init_mtx(&sc->sel.si_note, &sc->lock); sc->cred = crhold(td->td_ucred); @@ -557,17 +596,16 @@ inotify_queue_record(struct inotify_softc *sc, struct inotify_record *rec) return (true); } -static int +static void inotify_log_one(struct inotify_watch *watch, const char *name, size_t namelen, int event, uint32_t cookie) { struct inotify_watch key; struct inotify_softc *sc; struct inotify_record *rec; - int relecount; bool allocfail; - relecount = 0; + mtx_assert(&watch->vp->v_pollinfo->vpi_lock, MA_OWNED); sc = watch->sc; rec = inotify_alloc_record(watch->wd, name, namelen, event, cookie, @@ -596,20 +634,22 @@ inotify_log_one(struct inotify_watch *watch, const char *name, size_t namelen, /* * Remove the watch, taking care to handle races with - * inotify_close(). + * inotify_close(). The thread that removes the watch is + * responsible for freeing it. */ key.wd = watch->wd; if (RB_FIND(inotify_watch_tree, &sc->watches, &key) != NULL) { RB_REMOVE(inotify_watch_tree, &sc->watches, watch); inotify_unlink_watch_locked(sc, watch); - free(watch, M_INOTIFY); - /* Defer vrele() to until locks are dropped. */ - relecount++; + /* + * Defer the vrele() to a sleepable thread context. + */ + TAILQ_INSERT_TAIL(&sc->deadwatches, watch, vlink); + taskqueue_enqueue(taskqueue_thread, &sc->reaptask); } } mtx_unlock(&sc->lock); - return (relecount); } void @@ -617,25 +657,18 @@ inotify_log(struct vnode *vp, const char *name, size_t namelen, int event, uint32_t cookie) { struct inotify_watch *watch, *tmp; - int relecount; KASSERT((event & ~(IN_ALL_EVENTS | IN_ISDIR | IN_UNMOUNT)) == 0, ("inotify_log: invalid event %#x", event)); - relecount = 0; mtx_lock(&vp->v_pollinfo->vpi_lock); TAILQ_FOREACH_SAFE(watch, &vp->v_pollinfo->vpi_inotify, vlink, tmp) { KASSERT(watch->vp == vp, ("inotify_log: watch %p vp != vp", watch)); - if ((watch->mask & event) != 0 || event == IN_UNMOUNT) { - relecount += inotify_log_one(watch, name, namelen, event, - cookie); - } + if ((watch->mask & event) != 0 || event == IN_UNMOUNT) + inotify_log_one(watch, name, namelen, event, cookie); } mtx_unlock(&vp->v_pollinfo->vpi_lock); - - for (int i = 0; i < relecount; i++) - vrele(vp); } /*