git: a1d54f986368 - releng/14.0 - vfs cache: denote a known bug in cache_remove_cnp

The branch releng/14.0 has been updated by mjg:

URL: https://cgit.FreeBSD.org/src/commit/?id=a1d54f98636833a512db69bfa765f1da0a011cb0

commit a1d54f98636833a512db69bfa765f1da0a011cb0
Author:     Mateusz Guzik <mjg@FreeBSD.org>
AuthorDate: 2023-10-05 12:32:29 +0000
Commit:     Mateusz Guzik <mjg@FreeBSD.org>
CommitDate: 2023-10-14 01:06:47 +0000

    vfs cache: denote a known bug in cache_remove_cnp
    
    (cherry picked from commit cd2105d691f446f7dbddf5965d82b9e9103bc8d2)
    (cherry picked from commit 99bfb6998b00ac8edd1395d76d199ddee62d24a0)
    
    Approved by:    re (gjb)
---
 sys/kern/vfs_cache.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sys/kern/vfs_cache.c b/sys/kern/vfs_cache.c
index 0467619fe5d5..bd9eac69bfcb 100644
--- a/sys/kern/vfs_cache.c
+++ b/sys/kern/vfs_cache.c
@@ -1747,6 +1747,15 @@ retry_dotdot:
 		return (1);
 	}
 
+	/*
+	 * XXX note that access here is completely unlocked with no provisions
+	 * to keep the hash allocated. If one is sufficiently unlucky a
+	 * parallel cache resize can reallocate the hash, unmap backing pages
+	 * and cause the empty check below to fault.
+	 *
+	 * Fixing this has epsilon priority, but can be done with no overhead
+	 * for this codepath with sufficient effort.
+	 */
 	hash = cache_get_hash(cnp->cn_nameptr, cnp->cn_namelen, dvp);
 	blp = HASH2BUCKETLOCK(hash);
 retry: