⬢ DragonFlyBSD Kernel Audit
DF-5810 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -475,6 +475,8 @@
 vtruncbuf(struct vnode *vp, off_t length, int blksize)
 {
 	struct vtruncbuf_info info;
+	struct namecache *ncp;
+	char filename_buf[MAXNAMLEN + 1];
 	const char *filename;
 	int count;
 
@@ -529,8 +531,16 @@
 	 * Debugging only
 	 */
 	spin_lock(&vp->v_spin);
-	filename = TAILQ_FIRST(&vp->v_namecache) ?
-		   TAILQ_FIRST(&vp->v_namecache)->nc_name : "?";
+	ncp = TAILQ_FIRST(&vp->v_namecache);
+	if (ncp) {
+		/* DF-5810: snapshot the name under the spin; the ncp (and
+		 * its separately allocated nc_name) can be freed once the
+		 * spin is dropped while we block in the re-clean loop. */
+		strlcpy(filename_buf, ncp->nc_name, sizeof(filename_buf));
+		filename = filename_buf;
+	} else {
+		filename = "?";
+	}
 	spin_unlock(&vp->v_spin);
 
 	/*