DF-5810 / fix.diff
--- a/sys/kern/vfs_subr.c +++ b/sys/kern/vfs_subr.c @@ -475,6 +475,8 @@ vtruncbuf(struct vnode *vp, off_t length, int blksize) { struct vtruncbuf_info info; + struct namecache *ncp; + char filename_buf[MAXNAMLEN + 1]; const char *filename; int count; @@ -529,8 +531,16 @@ * Debugging only */ spin_lock(&vp->v_spin); - filename = TAILQ_FIRST(&vp->v_namecache) ? - TAILQ_FIRST(&vp->v_namecache)->nc_name : "?"; + ncp = TAILQ_FIRST(&vp->v_namecache); + if (ncp) { + /* DF-5810: snapshot the name under the spin; the ncp (and + * its separately allocated nc_name) can be freed once the + * spin is dropped while we block in the re-clean loop. */ + strlcpy(filename_buf, ncp->nc_name, sizeof(filename_buf)); + filename = filename_buf; + } else { + filename = "?"; + } spin_unlock(&vp->v_spin); /* |