From nobody Tue Aug 4 22:37:01 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hF7hG2Sh5z6nXwM for ; Tue, 04 Aug 2026 22:37:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hF7hG1PP1z3sss for ; Tue, 04 Aug 2026 22:37:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785883022; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mPLeM3peBdi4gbaVyQd3aRTKL1qQChsJRxYCcgcTaIo=; b=Okwu3ioM/ReCWYQiof++vRnsuKjUN+Ef/wMrzyDnZe9TMUJcfJ2+xyjUMUNvPtrtuUka2D G+j88PlzN9f+P/baFzmK2bbQ2SK0hpK7yrmWlpJsdkv2SRoTK1wBA/CpXZQJuIvVV2n5Dk QTAPf67NhMplHa8cs3fKdmTcIstsPXyBnZaLJLqgOW3svPKiQT+3t2epu5vFWouHGDAykv vbDUbwxrfBNo9u92+en81xXXfegKwD+Kd+F1x5wifyMkUz7ZgZacOew+X5Ml5/xee5a5Lk 0r5mgMEHMD6CcBF+FX2DNtDTuoDrXoHtSemufGaBSBHSEJrIW4kFr90kji6BmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785883022; a=rsa-sha256; cv=none; b=RNNJI05kWc6OtqThcMUWN2CwohR02m3qgdE2A8M9jyb2eNld+aDlo2wvkMCZjmECOj/UNA +QFfL7PNgDTRLzIaTFAXR+V/0N/3w3+/2HPUBIS6+kySm6EoTX009clhD07XllxG3rthJ4 dZ3SU7NHbvIg0C5FCKkvLnaumeZl0Wzz3W3jMT4h/41W0s4Qw7tCF0D39HQk3iFN8wYIRD fKZ2EGcFBEZx1+ZN83PVsXYg78ZDtlggGkNepP1bQhFw68etWOMJeqNYHwhmCoUo6LIi3V wE72KmQ7wPRJBCVTWMyBzvzHvgOWRM5Q+L73IRkmXq8O5FWo+/FCTRGR3ktNkw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785883022; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mPLeM3peBdi4gbaVyQd3aRTKL1qQChsJRxYCcgcTaIo=; b=kelT6MGraHMnzpgXHd/Z2wgu7Qw88lDuHu66AiF1jaHyXgoNsF4StVjD31GhAY6QgTm8w5 EtAEGBwWC0c18coRcNbU8EyVuAO6DHP7Umom8fD8QpHIMb7vrhOiY7klaPHW77Ol7gIJOu mEVOaKCyqAeBLQ2HuEtYOW+eaf3rchhkc2d5NKkw0SA0oEf+Y/WyPp+6d6K3pDBHh+6/xE QRMEFdCaocGJNA6LiznzBnSMMTclyVltXC+Bvvr59Axtkn0cxEVyrrQ6xKYiEpxTUFVDTp G9UkAI2Ud7hxRieR1UW6Lgy/xNZCZ8kNHIBIVKFayNwXEUULIVuj8VYL7jLQUA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hF7hF6qWqz16Kl for ; Tue, 04 Aug 2026 22:37:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18ef6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 04 Aug 2026 22:37:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: b95a859483f1 - main - autofs_lookup(): busy the mount point around autofs_trigger() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b95a859483f1ac0671bde55c0a2fc46f4db5ba4b Auto-Submitted: auto-generated Date: Tue, 04 Aug 2026 22:37:01 +0000 Message-Id: <6a72698d.18ef6.5ed0ef8c@gitrepo.freebsd.org> The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=b95a859483f1ac0671bde55c0a2fc46f4db5ba4b commit b95a859483f1ac0671bde55c0a2fc46f4db5ba4b Author: Konstantin Belousov AuthorDate: 2026-08-03 17:41:46 +0000 Commit: Konstantin Belousov CommitDate: 2026-08-04 22:36:13 +0000 autofs_lookup(): busy the mount point around autofs_trigger() Since autofs_lookup() calls into autofs_trigger_vn() to perform automounting, and autofs_trigger_vn() unlocks the vnode, it is possible for the unmount to start meantime. Then autofs_trigger() accesses freed memory. At this point, busy can be only done unblocking, and the transient failure must abort the trigger operation. This would cause spurious automounter errors, but at least should prevent accesses to the freed memory. PR: 294361 Reviewed by: markj, rew Tested by: rew Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58626 --- sys/fs/autofs/autofs_vnops.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/sys/fs/autofs/autofs_vnops.c b/sys/fs/autofs/autofs_vnops.c index b6424fc2ff4c..2d1e1f77eda5 100644 --- a/sys/fs/autofs/autofs_vnops.c +++ b/sys/fs/autofs/autofs_vnops.c @@ -136,16 +136,22 @@ autofs_trigger_vn(struct vnode *vp, const char *path, int pathlen, struct vnode **newvp) { struct autofs_node *anp; + struct mount *mp; int error, lock_flags; anp = vp->v_data; /* - * Release the vnode lock, so that other operations, in partcular - * mounting a filesystem on top of it, can proceed. Increase use - * count, to prevent the vnode from being deallocated and to prevent - * filesystem from being unmounted. + * Release the vnode lock, so that other operations, in + * particular mounting a filesystem on top of it, can proceed. + * Increase use count and busy the mount, to prevent the vnode + * from being deallocated and to prevent filesystem from being + * unmounted. */ + mp = vp->v_mount; + error = vfs_busy(mp, MBF_NOWAIT); + if (error != 0) + return (error); lock_flags = VOP_ISLOCKED(vp); vref(vp); VOP_UNLOCK(vp); @@ -165,6 +171,7 @@ mounted: sx_xunlock(&autofs_softc->sc_lock); vn_lock(vp, lock_flags | LK_RETRY); vunref(vp); + vfs_unbusy(mp); if (VN_IS_DOOMED(vp)) { AUTOFS_DEBUG("VIRF_DOOMED"); return (ENOENT);