git: 57bf745be964 - stable/14 - vfs offset: fix assertion failure in face of racing ffofset and setfl locking

The branch stable/14 has been updated by mjg:

URL: https://cgit.FreeBSD.org/src/commit/?id=57bf745be96462355350fa18ec1dadfa9f04a10d

commit 57bf745be96462355350fa18ec1dadfa9f04a10d
Author:     Mateusz Guzik <mjg@FreeBSD.org>
AuthorDate: 2025-10-05 17:03:54 +0000
Commit:     Mateusz Guzik <mjg@FreeBSD.org>
CommitDate: 2025-10-15 02:12:32 +0000

    vfs offset: fix assertion failure in face of racing ffofset and setfl locking
    
    Both use the same 16 bit var to store their locked and waiters bits,
    then this in file_v_unlock:
    
            state = atomic_load_16(flagsp);
            if ((state & lock_wait_bit) == 0 &&
                atomic_cmpset_rel_16(flagsp, state, state & ~lock_bit))
                    return;
    
    can fail if for example foffset is being unlocked while setfl is getting
    locked.
    
    Afterwards the code assumes there are blocked waiters on foffset.
    
    Reviewed by: kib, markj
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision: https://reviews.freebsd.org/D52915
---
 sys/kern/vfs_vnops.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index 5b25e2680ee4..4d1df41cf588 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -767,9 +767,12 @@ file_v_lock(struct file *fp, short lock_bit, short lock_wait_bit)
 
 	flagsp = &fp->f_vflags;
 	state = atomic_load_16(flagsp);
-	if ((state & lock_bit) == 0 &&
-	    atomic_cmpset_acq_16(flagsp, state, state | lock_bit))
-		return;
+	for (;;) {
+		if ((state & lock_bit) != 0)
+			break;
+		if (atomic_fcmpset_acq_16(flagsp, &state, state | lock_bit))
+			return;
+	}
 
 	sleepq_lock(flagsp);
 	state = atomic_load_16(flagsp);
@@ -803,9 +806,12 @@ file_v_unlock(struct file *fp, short lock_bit, short lock_wait_bit)
 
 	flagsp = &fp->f_vflags;
 	state = atomic_load_16(flagsp);
-	if ((state & lock_wait_bit) == 0 &&
-	    atomic_cmpset_rel_16(flagsp, state, state & ~lock_bit))
-		return;
+	for (;;) {
+		if ((state & lock_wait_bit) != 0)
+			break;
+		if (atomic_fcmpset_rel_16(flagsp, &state, state & ~lock_bit))
+			return;
+	}
 
 	sleepq_lock(flagsp);
 	MPASS((*flagsp & lock_bit) != 0);