NetBSD Problem Report #60632

From www@netbsd.org  Sat Aug 22 17:58:41 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A4CD51A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 22 Aug 2026 17:58:41 +0000 (UTC)
Message-Id: <20260822175840.589121A923E@mollari.NetBSD.org>
Date: Sat, 22 Aug 2026 17:58:40 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: vfs_getvfs races with unmount
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60632
>Category:       kern
>Synopsis:       vfs_getvfs races with unmount
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 22 18:00:01 +0000 2026
>Last-Modified:  Sat Aug 22 18:05:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetUAF Mountation, Inc.
>Environment:
>Description:

	By the time vfs_getvfs has returned a struct mount pointer, a
	concurrent unmount may have freed it.

>How-To-Repeat:

	code inspection

>Fix:

	1. Make vfs_getvfs do vfs_busy while the struct mount pointer
	   is still stable (between mountlist_iterator_next and
	   mountlist_iterator_destroy).

	2. Teach all the callers to do vfs_rele.

>Audit-Trail:
From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org, gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/60632: vfs_getvfs races with unmount
Date: Sat, 22 Aug 2026 18:00:58 +0000

 Correction: should be vfs_busy and vfs_unbusy, or vfs_ref and
 vfs_rele, but not mixed and matched the other way!

Home	PR Database Search