From nobody Thu Oct 22 17:32:05 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9Y9x6FgFz6xP2S for ; Thu, 22 Oct 2026 17:32:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9Y9x4V33z3H92 for ; Thu, 22 Oct 2026 17:32:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690325; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sXP5KVrRTt92oXBsbhirJAjQzMpTCGX6PxKZ35Z4tWs=; b=rCCXE3YqPHZ2lukvLpBhYH7lBq9yLI9aQCCtAIm7rfiL/rmi2G+w8bYcUNy9yuq4D8EtrO 2EBEQaESuSrMkP3sBl6gsckXJTRLkDxlX6t9q8pxL2Ml1ehzqWRyuru0c4BYmcDWNu07RD SpJd04YcSd8yQK3Y9v+/Ziv6dO/Q36QUAHnVRMu4VlLiRxzJHTYWvVN7xtD1OuOvdbY4DC 0wUDb1XrzARxzDKQ6TEB5RDqDnbbQtdM23m14+SZjx9InqOjy1NTvmXCWdRex6N9w7kIuP qrnXyy0EtzyU6JH+lD7ZeNeAZdU4rMf+z14loWwZ+nJ6tDv+Gmu5BopIMCaLQw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792690325; b=sQlXtPw+SgqDOTJIygVGl5UHAhcqaxZIZnAQ4x+/Q/e9GWOolnYQWw8rKbmsaQHXsUwtLJ oe8LX21/4iHJCVCKxPK4FSi/4psbG5JwGVwngjNeCz4HZgwOPcc6x4zeWzByU+Q/Pb4LXL tCqvd+iPvgFsq1ZHypsJ52lSP38vCJz1cu3W+t0RQAZG22DCRAFk5qNlCz6yyLYplguuUf Vf1YXFEd9NMb39g259DwaKasXBwQb6YKpvYODfLKcdKg7Nea90QL2wMzCpqZB9oXBoOorF nkJIGtDfjDYbiAqjgh7yAskDLslbH1LLN8i2QygQq7MKgPbhF/NPeqMXuwrqaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690325; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sXP5KVrRTt92oXBsbhirJAjQzMpTCGX6PxKZ35Z4tWs=; b=lkYRtwr9AZPLFGTTl2o8PZ99dD//N4/v0XpCQEuBq5Kwa0l79GqJlMoYka661GpTxIrd20 g/Tp59WHzmR9AY9uV8lEbsUvIzCpe7aFYEZZ1/CdvROgb4Rk+Kx9t2jqs7RDLWNvaPgkXK xsRo8AGhFbFlccLs2YnCWq8DBSY4aGwja2kZaUVM9ClnLQWcO+RzPUeuA1CdG721xSUL1Q ZBKL+ZWm7yBKJnofOxxoKkIFchDmgjJLH9LsoqYb2WjRfWdneqQdKNNzH9YxJHV1zY8ASZ 0MgIguwvL6mHX8oSEOIXYm81V09XxKThTybkN9FheQXnVQcOOY+vYvYWrsWtFQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9Y9x3DT7zrjJ for ; Thu, 22 Oct 2026 17:32:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3d746 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 22 Oct 2026 17:32:05 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 2893d756a70f - stable/15 - jail: Fix a race in prison_deref() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 2893d756a70f58cdbb7f066cfb873501d22d57c6 Auto-Submitted: auto-generated Date: Thu, 22 Oct 2026 17:32:05 +0000 Message-Id: <6ada4895.3d746.1ec27aa0@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2893d756a70f58cdbb7f066cfb873501d22d57c6 commit 2893d756a70f58cdbb7f066cfb873501d22d57c6 Author: Mark Johnston AuthorDate: 2026-09-25 15:16:24 +0000 Commit: Mark Johnston CommitDate: 2026-10-22 15:45:41 +0000 jail: Fix a race in prison_deref() If we're killing a jail which has some user refs pending, then we would first drop our ref and then kill all processes in the prison. However, it's possible for the prison to be freed before we finish that operation, generally if the processes exit on their own before prison_proc_iterate() returns. Thus, defer the release of the prison refcount until after we've killed all procs. Reviewed by: jamie MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59984 (cherry picked from commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f) --- sys/kern/kern_jail.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 5629f529b1dd..522b2306c928 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -3585,8 +3585,10 @@ prison_deref(struct prison *pr, int flags) * that need to be killed, either in this prison or its * descendants. */ - if (refcount_load(&pr->pr_uref) > 0) + if (refcount_load(&pr->pr_uref) > 0) { killpr = pr; + flags &= ~PD_DEREF; + } /* Make sure the parent prison doesn't get killed. */ flags &= ~PD_KILL; } @@ -3646,8 +3648,10 @@ prison_deref(struct prison *pr, int flags) sx_xunlock(&allprison_lock); /* Kill any processes attached to a killed prison. */ - if (killpr != NULL) + if (killpr != NULL) { prison_proc_iterate(killpr, prison_kill_processes_cb, NULL); + prison_free(killpr); + } /* * Finish removing any unreferenced prisons, which couldn't happen