HomeFreeBSD

unionfs: avoid vdrop()ing a locked but doomed vnode

Description

unionfs: avoid vdrop()ing a locked but doomed vnode

unionfs_lock() unconditionally calls vdrop() on the target vnode
after locking it, but it's possible this vnode may be doomed.
In that case, vdrop() may free the vnode, which in certain cases
requires taking the vnode lock. Commit a7aac8c20497d added an
assert to this effect, which unionfs_lock() now trips over.

Fix this by lightly reworking the flow of unionfs_lock() so that
the target vnode is vdrop()ed after being unlocked in the case
where the unionfs lock operation needs to be restarted (which
will happen if the unionfs vnode has been doomed, which is a
prerequisite for the target vnode in the underlying filesystem
to have been doomed).

While here, get rid of a superfluous vhold/vdrop sequence in
unionfs_unlock() that was probably inherited from nullfs and whose
nullfs equivalent was recently removed.

Reviewed by: kib, markj, olce
Tested by: pho
Differential Revision: https://reviews.freebsd.org/D53107

(cherry picked from commit a498c5e1a111ae8c48b8e7028daff861785c2bf2)

Details

Provenance
jahAuthored on Oct 14 2025, 7:40 PM
Reviewer
kib
Differential Revision
D53107: unionfs: avoid vdrop()ing a locked but doomed vnode
Parents
rG8a873a86059f: unionfs: fix NULL deref on closing an fd passed through SCM_RIGHTS
Branches
Unknown
Tags
Unknown