git: 8a873a86059f - stable/15 - unionfs: fix NULL deref on closing an fd passed through SCM_RIGHTS

The branch stable/15 has been updated by jah:

URL: https://cgit.FreeBSD.org/src/commit/?id=8a873a86059f13c829315b7867e188d27e314b51

commit 8a873a86059f13c829315b7867e188d27e314b51
Author:     Jason A. Harmening <jah@FreeBSD.org>
AuthorDate: 2025-10-13 20:40:46 +0000
Commit:     Jason A. Harmening <jah@FreeBSD.org>
CommitDate: 2025-11-03 04:32:50 +0000

    unionfs: fix NULL deref on closing an fd passed through SCM_RIGHTS
    
    If the last reference to an open file is contained in an SCM_RIGHTS
    message in a UNIX domain socket, and that message is discarded without
    being read out by the receiver, VOP_CLOSE will ultimately be called
    with ap->a_td == NULL.
    
    Change unionfs_close() to check for this condition instead of blindly
    passing the thread to unionfs_find_node_status() which will try to
    dereference it.  Also add relevant asserts on the node status lookup
    paths.
    
    PR:             289700
    Reported by:    asomers
    Reviewed by:    asomers, olce
    Differential Revision: https://reviews.freebsd.org/D53079
    
    (cherry picked from commit 880d180bb21c764aec6bd5bc8c0a6b07b8c2e199)
---
 sys/fs/unionfs/union_subr.c  | 2 ++
 sys/fs/unionfs/union_vnops.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/fs/unionfs/union_subr.c b/sys/fs/unionfs/union_subr.c
index edcc6716b674..f99d9fe9ca35 100644
--- a/sys/fs/unionfs/union_subr.c
+++ b/sys/fs/unionfs/union_subr.c
@@ -587,6 +587,7 @@ unionfs_find_node_status(struct unionfs_node *unp, struct thread *td)
 	struct unionfs_node_status *unsp;
 	pid_t pid;
 
+	MPASS(td != NULL);
 	pid = td->td_proc->p_pid;
 
 	ASSERT_VOP_ELOCKED(UNIONFSTOV(unp), __func__);
@@ -612,6 +613,7 @@ unionfs_get_node_status(struct unionfs_node *unp, struct thread *td,
 	struct unionfs_node_status *unsp;
 	pid_t pid;
 
+	MPASS(td != NULL);
 	pid = td->td_proc->p_pid;
 
 	KASSERT(NULL != unspp, ("%s: NULL status", __func__));
diff --git a/sys/fs/unionfs/union_vnops.c b/sys/fs/unionfs/union_vnops.c
index 03130f0ca949..0a91d1d5ed02 100644
--- a/sys/fs/unionfs/union_vnops.c
+++ b/sys/fs/unionfs/union_vnops.c
@@ -814,7 +814,7 @@ unionfs_close(struct vop_close_args *ap)
 	unp = VTOUNIONFS(vp);
 	lvp = unp->un_lowervp;
 	uvp = unp->un_uppervp;
-	unsp = unionfs_find_node_status(unp, td);
+	unsp = (td != NULL) ? unionfs_find_node_status(unp, td) : NULL;
 
 	if (unsp == NULL ||
 	    (unsp->uns_lower_opencnt <= 0 && unsp->uns_upper_opencnt <= 0)) {