tmpfs - Close rare vnode recycle race
authorMatthew Dillon <dillon@apollo.backplane.com>
Sat, 14 Sep 2019 14:35:51 +0000 (07:35 -0700)
committerMatthew Dillon <dillon@apollo.backplane.com>
Sat, 14 Sep 2019 14:35:51 +0000 (07:35 -0700)
commit89984f3d2cfccbd968e1d909a7941d20cf370f5d
treea27751880072c0a4aa6f7c6445ca974355780142
parent0ad80e33db0a3241abcd15552e6cf0c61ca54543
tmpfs - Close rare vnode recycle race

* Keep the node lock held when clearing tn_vnode in tmpfs_reclaim()
  to protect against a use-after-free race on tn_vnode against another
  thread.

* Keep the node locked across the node type check and vnode
  ref in tmpfs_unmount() to protect against asynchronous
  reclamation races.
sys/vfs/tmpfs/tmpfs.h
sys/vfs/tmpfs/tmpfs_subr.c
sys/vfs/tmpfs/tmpfs_vfsops.c
sys/vfs/tmpfs/tmpfs_vnops.c