Page MenuHomeFreeBSD

gcache: fix use-after-free when invalidate races bio completion
Needs ReviewPublic

Authored by oshogbo on Jun 9 2026, 11:31 AM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Jul 20, 7:52 AM
Unknown Object (File)
Tue, Jun 30, 7:27 AM
Unknown Object (File)
Tue, Jun 30, 7:24 AM
Unknown Object (File)
Sun, Jun 28, 3:24 PM
Unknown Object (File)
Sun, Jun 28, 3:16 PM
Unknown Object (File)
Jun 20 2026, 3:40 PM
Unknown Object (File)
Jun 19 2026, 6:47 AM
Unknown Object (File)
Jun 17 2026, 7:32 PM
Subscribers

Details

Reviewers
mav
imp
Summary

If a write invalidates a cache entry while a read is still in flight,
the entry is kept around until the read finishes.

When the read completed, the entry was put back on the used list and
then freed, leaving a dangling pointer on the list that caused later
panics.

Don't put invalidated entries back on the used list.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295609

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 73757
Build 70640: arc lint + arc unit