From nobody Mon Jul 27 19:14:47 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h87Zc2kTGz6nQPg for ; Mon, 27 Jul 2026 19:14:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h87Zc0qS1z3fHJ for ; Mon, 27 Jul 2026 19:14:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785179688; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hlv2UDY1F7FHok7fo5dqDQ2eg6olIG1pev/AFa9BMbY=; b=xM6pGyo9jdc8Emg8+7S4CipktKz8ZwrkuCsWSyJhsDP9Zpjr0GZuCfDVzN5X0d2A9KEFfz G+Xqrm+m3NqWnJSjcBOdiPrNpzIRki/WqnGUF/GEZI2EmSqe/ip0QgRrYIk4cqN/tF91In Q5O182DwQvnRQK7tgQOH0A5NRz4J0c4xo/Kc3ugL88Y524Cs6LOiRW/scCEB85ILPmTLTl W8SwQn02SaEkFppOAf6bMqo+d5XjIMnv9BLAufmBHfbvEfx0F/EGMH2hZiJKfe/VUuwGzV YakTgdiC8yVQMEjIFv+1W4ICokohg71CcJqRMzrV1hxkIj2ekrhx16XY2ynQJA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785179688; a=rsa-sha256; cv=none; b=PphNd8aB/j9cMqBm9aMu5/CIqSq7XmNSg3fqZ/Qe3DqiwVh+5Ukk7ky+4HuRMmzHMI+8El ypuYhwshdcwic2HQm5FGTCNM4c2mn3g+bJtw/WQguU5SbskpKyAMLlwwCvngvjwA2bK4zd FT6sHBrNpPOYyY74GmkYgxjclrcm2OLiSPmIsXWpKENTB2lCTWdV9epx9C171r7j2dfYcq owIdSmxGbLsWtQb6xXbTmk0KzbSPvh1mnB6p+2/3S3J0sDYPs/CkXW+ZX8XQPBVBD8AhsB XtmqAkh2b6ESOcQsmtJFBtYSwxbxXtvrYBts6OBW9lPvhPSYSioKbPQsfGT19Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785179688; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hlv2UDY1F7FHok7fo5dqDQ2eg6olIG1pev/AFa9BMbY=; b=tfocXMUxhCD7goc1vBVlfdJM4SnPcCS23NByrHSe9u5DP/IpYLYoZsPnxdfNRVQ9Tw5/cQ S7vdWKfAauQlQkvsE4/ml6FcjAJBPs969wwUWfjRCjnITuioK1De5wfxz+IOooAFuClo+v +NHfNVr0NjRJ+U7dxxvhYXbMATSGUhu8u0Q/R/ezqWF3EYpWgUq9chGO3tdVSwISXWsiFA Mmf12JMp/kodOKsFpGF5N99Z5VvdjwNryEFvjXWDbHLOU0+ibl8VtHuq3LIQ9Z8/WSt2+N aJ7H9uRNQSizPPQKevaxR48D3Ia/cinDwe4AnLKxSXtfg2LcMFkKsgkTiELFEQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h87Zb6rr3z1Krn for ; Mon, 27 Jul 2026 19:14:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 36b6d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 27 Jul 2026 19:14:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8496ed27ab06 - stable/15 - jaildesc: Publish the new fd only after the jaildesc is initialized List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8496ed27ab065ca404d7dc9e599023d14b00f5e8 Auto-Submitted: auto-generated Date: Mon, 27 Jul 2026 19:14:47 +0000 Message-Id: <6a67ae27.36b6d.5b0edfe2@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8496ed27ab065ca404d7dc9e599023d14b00f5e8 commit 8496ed27ab065ca404d7dc9e599023d14b00f5e8 Author: Mark Johnston AuthorDate: 2026-07-06 12:51:11 +0000 Commit: Mark Johnston CommitDate: 2026-07-27 17:34:31 +0000 jaildesc: Publish the new fd only after the jaildesc is initialized jaildesc_alloc() finishes initializing the file structure only after it is made visible from the file descriptor table via finit(). In that window, other threads could try to perform operations on the descriptor and thus access an incompletely initialized jaildesc. Defer the finit() call until locks are initialized. While here, simplify the error path for falloc_caps(). Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai Reviewed by: jamie MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58049 (cherry picked from commit 38dd686b9336e2de5deadc5f8cb5e46a845b0dd9) --- sys/kern/kern_jaildesc.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/sys/kern/kern_jaildesc.c b/sys/kern/kern_jaildesc.c index d6a7649ec484..f8f396405284 100644 --- a/sys/kern/kern_jaildesc.c +++ b/sys/kern/kern_jaildesc.c @@ -129,18 +129,16 @@ jaildesc_alloc(struct thread *td, struct file **fpp, int *fdp, int owning) if (error != 0) return (error); } - jd = malloc(sizeof(*jd), M_JAILDESC, M_WAITOK | M_ZERO); error = falloc_caps(td, &fp, fdp, 0, NULL); - if (error != 0) { - free(jd, M_JAILDESC); + if (error != 0) return (error); - } - finit(fp, priv_check_cred(fp->f_cred, PRIV_JAIL_SET) == 0 ? - FREAD | FWRITE : FREAD, DTYPE_JAILDESC, jd, &jaildesc_ops); + jd = malloc(sizeof(*jd), M_JAILDESC, M_WAITOK | M_ZERO); JAILDESC_LOCK_INIT(jd); knlist_init_mtx(&jd->jd_selinfo.si_note, &jd->jd_lock); if (owning) jd->jd_flags |= JDF_OWNING; + finit(fp, priv_check_cred(fp->f_cred, PRIV_JAIL_SET) == 0 ? + FREAD | FWRITE : FREAD, DTYPE_JAILDESC, jd, &jaildesc_ops); *fpp = fp; return (0); }