diff options
| author | Mateusz Guzik <mjg@FreeBSD.org> | 2025-10-05 17:03:54 +0000 |
|---|---|---|
| committer | Mateusz Guzik <mjg@FreeBSD.org> | 2025-10-05 21:21:34 +0000 |
| commit | b1de02c415de5df2d24d8021827634fc095b7a26 (patch) | |
| tree | c22a4915fd1af57849b5e8964696d380c39ab2d1 | |
| parent | f16178e0bba81c32b1f4fba310c7d0f2756aca85 (diff) | |
vfs offset: fix assertion failure in face of racing ffofset and setfl locking
Both use the same 16 bit var to store their locked and waiters bits,
then this in file_v_unlock:
state = atomic_load_16(flagsp);
if ((state & lock_wait_bit) == 0 &&
atomic_cmpset_rel_16(flagsp, state, state & ~lock_bit))
return;
can fail if for example foffset is being unlocked while setfl is getting
locked.
Afterwards the code assumes there are blocked waiters on foffset.
Reviewed by: kib, markj
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D52915
| -rw-r--r-- | sys/kern/vfs_vnops.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index c2a669dc771a..a53df50c06bd 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -806,9 +806,12 @@ file_v_lock(struct file *fp, short lock_bit, short lock_wait_bit) flagsp = &fp->f_vflags; state = atomic_load_16(flagsp); - if ((state & lock_bit) == 0 && - atomic_cmpset_acq_16(flagsp, state, state | lock_bit)) - return; + for (;;) { + if ((state & lock_bit) != 0) + break; + if (atomic_fcmpset_acq_16(flagsp, &state, state | lock_bit)) + return; + } sleepq_lock(flagsp); state = atomic_load_16(flagsp); @@ -842,9 +845,12 @@ file_v_unlock(struct file *fp, short lock_bit, short lock_wait_bit) flagsp = &fp->f_vflags; state = atomic_load_16(flagsp); - if ((state & lock_wait_bit) == 0 && - atomic_cmpset_rel_16(flagsp, state, state & ~lock_bit)) - return; + for (;;) { + if ((state & lock_wait_bit) != 0) + break; + if (atomic_fcmpset_rel_16(flagsp, &state, state & ~lock_bit)) + return; + } sleepq_lock(flagsp); MPASS((*flagsp & lock_bit) != 0); |