DF-2700
vfs_hang_addrlist() returns through 'out' while still holding NE_LOCK(nep) on the rn_inithead-failure and unsupported-sa_family paths
| Field | Value |
|---|---|
| ID | DF-2700 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-667 Improper Locking |
| File | sys/kern/vfs_subr.c |
| Lines | 2085-2101 (unlock at :2097) |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
NE_LOCK(nep) is taken at :2085, but the error gotos at :2089 (rn_inithead failure) and :2094 (unsupported sa_family — trivially reached with AF_UNIX in ex_addr) jump to 'out' without NE_UNLOCK. Because NE_LOCK is lwkt_getpooltoken and lwkt_switch force-releases all of a thread's tokens at deschedule, the leak self-heals at the next deschedule: no persistent deadlock, only a transient mutual-exclusion contract violation (other CPUs may briefly block on the pool slot). Info/hardening.
Recommended fix
Unlock before both error gotos (see findings/ row diff — add
NE_UNLOCK(nep); before each goto out;).
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_subr.c (GLM 5.3).
No comments yet.