Page MenuHomeFreeBSD

inotify: Avoid calling vrele() with a namecache mutex held
ClosedPublic

Authored by markj on Aug 1 2025, 6:23 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Jan 30, 7:04 PM
Unknown Object (File)
Fri, Jan 30, 12:45 AM
Unknown Object (File)
Dec 27 2025, 7:30 AM
Unknown Object (File)
Dec 16 2025, 4:20 AM
Unknown Object (File)
Dec 16 2025, 4:20 AM
Unknown Object (File)
Dec 13 2025, 10:02 PM
Unknown Object (File)
Nov 15 2025, 9:24 PM
Unknown Object (File)
Nov 4 2025, 5:01 PM
Subscribers

Details

Summary

In cache_vop_inotify(), we call inotify_log() with a namecache hash lock
held. inotify_log() looks at all watches registered with the vnode to
see if any of them are interested in the event. In some cases, we have
to detach and free the watch after logging the event. This means we
must vrele() the watched vnode, and this must not be done while a
non-sleepable lock held.

Previously, I deferred the vrele() to until the inotify softc and vnode
pollinfo locks were dropped. However, this is not enough since we may
still be holding the aforementioned namecache lock. Go further and use
a taskqueue thread to release vnode references. Introduce a set of
detached watches, and queue a threaded task which releases the vnode
reference.

Reported by: syzbot+c128f121cb22df95559b@syzkaller.appspotmail.com
Fixes: f1f230439fa4 ("vfs: Initial revision of inotify")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Aug 1 2025, 6:23 PM
sys/kern/vfs_inotify.c
172

Why this needs to be tree and not e.g. just a list?

markj marked an inline comment as done.

Use tailq linkage instead.

This revision is now accepted and ready to land.Aug 1 2025, 8:04 PM