FOFFSETLOCK acquisition sleeps uninterruptibly ('fpoff', no PCATCH): a thread wedged forever inside VOP_READ while holding the offset lock makes every other thread sharing the file descriptor permanently unkillable

Summary

vn_get_fpf_offset blocks on FOFFSETLOCK via tsleep with no PCATCH, no timeout. The lock is held across the entire VOP_READ/VOP_WRITE. If the holder blocks uninterruptibly inside the FS (hard-mounted NFS read against a dead server, wedged device), every other thread sharing the fp (fork, SCM_RIGHTS) sleeps unkillably in 'fpoff' forever — amplification of any storage hang into a permanent unkillable-D-state process leak. FIFO/device reads are signal-interruptible and release the lock on ERESTART, so the stock guest cannot demonstrate it — speculative.

Recommended fix

tsleep(&fp->f_flag, PINTERLOCKED | PCATCH, "fpoff", 0) and return EINTR/ERESTART on signal (callers already release the lock on all return paths).

Timeline

• 2026-08-30 Discovered during pass-2 audit of vfs_vnops.c (GLM 5.3).