git: f43e19db6cea - stable/15 - vfs offset: fix assertion failure in face of racing ffofset and setfl locking

The branch stable/15 has been updated by mjg:

URL: https://cgit.FreeBSD.org/src/commit/?id=f43e19db6cea0a7dd7bf51f3fe2227d466ea5a80

commit f43e19db6cea0a7dd7bf51f3fe2227d466ea5a80
Author:     Mateusz Guzik <mjg@FreeBSD.org>
AuthorDate: 2025-10-05 17:03:54 +0000
Commit:     Mateusz Guzik <mjg@FreeBSD.org>
CommitDate: 2025-10-15 02:12:05 +0000

    vfs offset: fix assertion failure in face of racing ffofset and setfl locking
    
    Both use the same 16 bit var to store their locked and waiters bits,
    then this in file_v_unlock:
    
            state = atomic_load_16(flagsp);
            if ((state & lock_wait_bit) == 0 &&
                atomic_cmpset_rel_16(flagsp, state, state & ~lock_bit))
                    return;
    
    can fail if for example foffset is being unlocked while setfl is getting
    locked.
    
    Afterwards the code assumes there are blocked waiters on foffset.
    
    Reviewed by: kib, markj
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision: https://reviews.freebsd.org/D52915
---
 sys/kern/vfs_vnops.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index f81c2033d95e..e27692ccb1a3 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -806,9 +806,12 @@ file_v_lock(struct file *fp, short lock_bit, short lock_wait_bit)
 
 	flagsp = &fp->f_vflags;
 	state = atomic_load_16(flagsp);
-	if ((state & lock_bit) == 0 &&
-	    atomic_cmpset_acq_16(flagsp, state, state | lock_bit))
-		return;
+	for (;;) {
+		if ((state & lock_bit) != 0)
+			break;
+		if (atomic_fcmpset_acq_16(flagsp, &state, state | lock_bit))
+			return;
+	}
 
 	sleepq_lock(flagsp);
 	state = atomic_load_16(flagsp);
@@ -842,9 +845,12 @@ file_v_unlock(struct file *fp, short lock_bit, short lock_wait_bit)
 
 	flagsp = &fp->f_vflags;
 	state = atomic_load_16(flagsp);
-	if ((state & lock_wait_bit) == 0 &&
-	    atomic_cmpset_rel_16(flagsp, state, state & ~lock_bit))
-		return;
+	for (;;) {
+		if ((state & lock_wait_bit) != 0)
+			break;
+		if (atomic_fcmpset_rel_16(flagsp, &state, state & ~lock_bit))
+			return;
+	}
 
 	sleepq_lock(flagsp);
 	MPASS((*flagsp & lock_bit) != 0);