From nobody Mon Oct 26 19:46:58 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zk5CF8z6xWf0 for ; Mon, 26 Oct 2026 19:46:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jD3zk1tCRz4qc1 for ; Mon, 26 Oct 2026 19:46:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=InW4eF74zHaGZBjYl3IXoWBVtR2ZaxAhdac1lh9NRZY=; b=O5N0uQ1BSjTHXJM79PFeq7/GnBoBIqLCUgYF3tse54fITBKXXfu1X6N9TjsLXFcvh/mC29 XsGQk9/JQ2VVc2LXspXIn1myp/ZEznBJmI0576otP7mpasaqP8bwne75WcI9e6Iv+gT3a1 IPMmpwJpjHdTwzQJCCLQ1Y59qIQVp7D8mcsSQliWGkT6Et1Oj/CRtcNETshKeDQ/PxgLUa +Cc3Nbe2PvE55bnKuldAKbG4lffUGhDB4B45d2mQ+i7dDSE6ZwqMf/JJU1W0x4EaZHgOyh GR0IksqyQyiOYi0O7UmBFGfi9xtCJhDfrYsprvko9loEg1NwSYJc90owxlEGWg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793044018; b=MXmJc/4cqBdNdmNihZmgvIqyM8t2mSMxMzGGzeSs7kydsC9IeRSEciDjM1Hb7KqCmPhgK8 azelFWBeJFL2sYAQ/uuxAPqkFvxP3J0GN/dy63JDIwMEdGM2isL0RKurb/wJobbZ4SAe98 nxjWXa3UHT2UL/Eve/9I2cQBK660Te7e/ZNyaHi/tcI+O9guvG3DrbilUugY7xe66AoQO8 FqmX/eiVFpbGVlBQdnAMv78aBijq5kT1DA6Aznz48Z1MM4zG36hg4BZn2kfFbqkj6etnU0 llAddTpBJQtlL54AwKIjwqlBo2CHX57/cWjtGrs92Rc5FMdNaYxnuQzzLptd3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=InW4eF74zHaGZBjYl3IXoWBVtR2ZaxAhdac1lh9NRZY=; b=P8OhvDdjC4hW1PlDFHLlEsTzXC6h/9heqDyC9SYI2JXN6MwUgB0B+ewnhzBdapwU13vWQ+ z1okNsgzqGgS7msxja2No0w6ggCsZEg6Ox+f5SX14rKhl8aRAIxlso649qpqsUPkxQcvsp GBS18gTDiXBToni3H3LtUH28oAO3guO5auTewoHU3fiPbUEZUr17SJHUCNKwt6TjXblVqk vdOYkrAjQo0/lfA8ofO3XWd6g0UQ7DWnjcTsl6rb6zC35k69EPdLLlrbBzpf78NJK8v9kR En7Ua4bWByVKpnjX1E/DgGVLAvTMVdG9mnfTZpOepKLZxkgMKcJrhyaxTc+yOg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zk1RYlzp9y for ; Mon, 26 Oct 2026 19:46:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 38ce8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 26 Oct 2026 19:46:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c495bc190985 - stable/14 - jail: Fix a race in prison_deref() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c495bc19098528b642e93839e89ca29133025e81 Auto-Submitted: auto-generated Date: Mon, 26 Oct 2026 19:46:58 +0000 Message-Id: <6adfae32.38ce8.6bc95a55@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c495bc19098528b642e93839e89ca29133025e81 commit c495bc19098528b642e93839e89ca29133025e81 Author: Mark Johnston AuthorDate: 2026-09-25 15:16:24 +0000 Commit: Mark Johnston CommitDate: 2026-10-26 14:12:15 +0000 jail: Fix a race in prison_deref() If we're killing a jail which has some user refs pending, then we would first drop our ref and then kill all processes in the prison. However, it's possible for the prison to be freed before we finish that operation, generally if the processes exit on their own before prison_proc_iterate() returns. Thus, defer the release of the prison refcount until after we've killed all procs. Reviewed by: jamie MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59984 (cherry picked from commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f) --- sys/kern/kern_jail.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 5e2992527cf2..73f4480c4184 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -3221,8 +3221,10 @@ prison_deref(struct prison *pr, int flags) * that need to be killed, either in this prison or its * descendants. */ - if (refcount_load(&pr->pr_uref) > 0) + if (refcount_load(&pr->pr_uref) > 0) { killpr = pr; + flags &= ~PD_DEREF; + } /* Make sure the parent prison doesn't get killed. */ flags &= ~PD_KILL; } @@ -3282,8 +3284,10 @@ prison_deref(struct prison *pr, int flags) sx_xunlock(&allprison_lock); /* Kill any processes attached to a killed prison. */ - if (killpr != NULL) + if (killpr != NULL) { prison_proc_iterate(killpr, prison_kill_processes_cb, NULL); + prison_free(killpr); + } /* * Finish removing any unreferenced prisons, which couldn't happen