git: b95a859483f1 - main - autofs_lookup(): busy the mount point around autofs_trigger()

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=b95a859483f1ac0671bde55c0a2fc46f4db5ba4b

commit b95a859483f1ac0671bde55c0a2fc46f4db5ba4b
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-08-03 17:41:46 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-08-04 22:36:13 +0000

    autofs_lookup(): busy the mount point around autofs_trigger()
    
    Since autofs_lookup() calls into autofs_trigger_vn() to perform
    automounting, and autofs_trigger_vn() unlocks the vnode, it is possible
    for the unmount to start meantime.  Then autofs_trigger() accesses freed
    memory.
    
    At this point, busy can be only done unblocking, and the transient
    failure must abort the trigger operation.  This would cause spurious
    automounter errors, but at least should prevent accesses to the freed
    memory.
    
    PR:     294361
    Reviewed by:    markj, rew
    Tested by:      rew
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D58626
---
 sys/fs/autofs/autofs_vnops.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/sys/fs/autofs/autofs_vnops.c b/sys/fs/autofs/autofs_vnops.c
index b6424fc2ff4c..2d1e1f77eda5 100644
--- a/sys/fs/autofs/autofs_vnops.c
+++ b/sys/fs/autofs/autofs_vnops.c
@@ -136,16 +136,22 @@ autofs_trigger_vn(struct vnode *vp, const char *path, int pathlen,
     struct vnode **newvp)
 {
 	struct autofs_node *anp;
+	struct mount *mp;
 	int error, lock_flags;
 
 	anp = vp->v_data;
 
 	/*
-	 * Release the vnode lock, so that other operations, in partcular
-	 * mounting a filesystem on top of it, can proceed.  Increase use
-	 * count, to prevent the vnode from being deallocated and to prevent
-	 * filesystem from being unmounted.
+	 * Release the vnode lock, so that other operations, in
+	 * particular mounting a filesystem on top of it, can proceed.
+	 * Increase use count and busy the mount, to prevent the vnode
+	 * from being deallocated and to prevent filesystem from being
+	 * unmounted.
 	 */
+	mp = vp->v_mount;
+	error = vfs_busy(mp, MBF_NOWAIT);
+	if (error != 0)
+		return (error);
 	lock_flags = VOP_ISLOCKED(vp);
 	vref(vp);
 	VOP_UNLOCK(vp);
@@ -165,6 +171,7 @@ mounted:
 	sx_xunlock(&autofs_softc->sc_lock);
 	vn_lock(vp, lock_flags | LK_RETRY);
 	vunref(vp);
+	vfs_unbusy(mp);
 	if (VN_IS_DOOMED(vp)) {
 		AUTOFS_DEBUG("VIRF_DOOMED");
 		return (ENOENT);