DF-3241 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 | --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -417,8 +417,20 @@ lwkt_gettoken_shared(&mountlist_token); mp = mount_rb_tree_RB_LOOKUP_FSID(&mounttree, fsid); - if (mp) + /* + * DF-3241: do not hand out mounts being torn down. dounmount() + * runs VFS_UNMOUNT() (which frees the filesystem-private mount + * data and clears mp->mnt_data) *before* removing the mount from + * the mount list, so a lookup racing that window would return a + * mount whose mnt_data is NULL/stale. All fsid-based consumers + * (nfsrv_fhtovp, fhopen/fhstat/fhstatfs/fhstatvfs, checkpoint) + * expect a fully-live mount; ESTALE is the correct answer for + * a mount that is on its way out. + */ + if (mp && (mp->mnt_kern_flag & MNTK_UNMOUNT) == 0) mount_hold(mp); + else + mp = NULL; lwkt_reltoken(&mountlist_token); return (mp); } --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -5018,8 +5018,17 @@ if (error) return (error); - if ((mp = vfs_getvfs(&fh.fh_fsid)) == NULL) + if ((mp = vfs_getvfs(&fh.fh_fsid)) == NULL) { error = ESTALE; + } else if (vfs_busy(mp, LK_NOWAIT)) { + /* + * DF-3241: mount is being unmounted; its mnt_data may + * already be gone. ESTALE is the correct answer. + */ + mount_drop(mp); + mp = NULL; + error = ESTALE; + } if (error == 0) { if ((error = VFS_FHTOVP(mp, NULL, &fh.fh_fid, &vp)) == 0) { error = vn_stat(vp, &sb, td->td_ucred); @@ -5028,8 +5037,10 @@ } if (error == 0) error = copyout(&sb, uap->sb, sizeof(sb)); - if (mp) + if (mp) { + vfs_unbusy(mp); mount_drop(mp); + } return (error); } --- a/sys/vfs/nfs/nfs_subs.c +++ b/sys/vfs/nfs/nfs_subs.c @@ -1235,12 +1235,24 @@ mp = *mpp = vfs_getvfs(&fhp->fh_fsid); if (mp == NULL) return (ESTALE); + /* + * DF-3241: hold the mount busy across the CHECKEXP/FHTOVP pair so + * a concurrent dounmount() cannot free mnt_data underneath us. + * vfs_busy() fails once MNTK_UNMOUNT is set. + */ + if (vfs_busy(mp, LK_NOWAIT)) { + mount_drop(mp); + *mpp = NULL; + return (ESTALE); + } error = VFS_CHECKEXP(mp, nam, &exflags, &credanon); if (error) { + vfs_unbusy(mp); mount_drop(mp); return (error); } error = VFS_FHTOVP(mp, NULL, &fhp->fh_fid, vpp); + vfs_unbusy(mp); mount_drop(mp); if (error) return (ESTALE); --- a/sys/vfs/ufs/ufs_vfsops.c +++ b/sys/vfs/ufs/ufs_vfsops.c @@ -240,6 +240,8 @@ struct ufsmount *ump; ump = VFSTOUFS(mp); + if (ump == NULL) /* DF-3241: mid-unmount, mnt_data gone */ + return (EACCES); /* * Get the export permission structure for this <mp, client> tuple. */ --- a/sys/vfs/ufs/ffs_vfsops.c +++ b/sys/vfs/ufs/ffs_vfsops.c @@ -1213,6 +1213,8 @@ struct fs *fs; ufhp = (struct ufid *)fhp; + if (VFSTOUFS(mp) == NULL) /* DF-3241: mid-unmount, mnt_data gone */ + return (ESTALE); fs = VFSTOUFS(mp)->um_fs; if (ufhp->ufid_ino < UFS_ROOTINO || ufhp->ufid_ino >= fs->fs_ncg * fs->fs_ipg) |