From nobody Fri Sep 25 17:00:45 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hrxmF4DmWz6tfRr for ; Fri, 25 Sep 2026 17:00:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hrxmF22z7z4VLK for ; Fri, 25 Sep 2026 17:00:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790355645; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mS+2nEQbG+XU2Ryt7YKgLdxo2vjiA8oQItJmn7bTm3w=; b=TaVLRa3C5V02zWiWJsv+gS+rbsjmYT0N/FwQgdW7IjuedZLHoEottsoD81w2RYAs7xktB0 r6+KscKtRSeKEZY19IJLno47c2ILPpcTYJHDVipv/v18Z0nthUF3eU8yYyu+6DzH3Y7nfS SorpdD5RaPR6JFTQJ8fnN+1uo4u3XkWhNPVTLSJEPCezEsjXCdRLfeOKa/a3wvkEQXcI97 imePy67bqzReTvpyBq1gdsn4uUBCtvZnrXDsNeS8Zbuhp0hz9L+5Tm/rhiUhFfuR7OhUA6 pybShOfwbG453s2qe00/CaXpqUq9izPgMnK8uJxmEZ6MxCghB73zkPjK4uw4gA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790355645; b=alWiSW0H6jWL7A4h6ALEJHNzJEqaa7zFfo5XECkwc0aCtHpmBTRtkOOCFtaZ3xTPOYvSPR R3NUu22zw07Pyba65ROuOx70QqHhJN8Dce/FRqf50DnzhFIyEFIe2rSWPk1D7stJakq4e4 4q5p5j0/eCCNiDkiTUPxKeW1JKPRhllPTkVfDxYxjuFJAk3T/Xwb3Ng2ThFopFQ9fwOhUZ lH4rRX9+nmVaVVxqhjbTaY7TPwf4PYg9BvPjxy8FFoNN6Og3E9GF98fPHb/k4+DnPIUfUD fN6Vy3/oycUbnnOkQscIx4aG1EeereS60RLKpRimHUuS+3A6RZI4hI8zyVS0OQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790355645; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mS+2nEQbG+XU2Ryt7YKgLdxo2vjiA8oQItJmn7bTm3w=; b=TW7CxPSV0meZdU/hQhuln+jykU/na7euw1ZQQki6j321Qfl44SrPdofIOD6iAYkqCI1mgG IDzs14Nn/UJL4OBTvvHYeyyx8AYPDwqak5oiDLwaS9t9Y8Bhb89HkAgEC+KHQ5qy3LVsRt DHG8CnXvsvmwCS8x1n6AxRFwEmcPunHT16v7lVFfFJsyR/xxGJW9xMaPWAh2P1v+UxvgZu TOQTMNWWwuT4e/F2/lvSrg9GjxFpF0JDQ/5xyj2KoLeK0YBxIrv8zwj+pADLGlEko23OpB uyU/c2SO9kNncVEq/P4gl4eIhiXes8KIVlTdCVdvqzf8dm1iXMtD0g1YaWVbkg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hrxmF10HLzJg4 for ; Fri, 25 Sep 2026 17:00:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e64d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 25 Sep 2026 17:00:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 79af745f4c29 - main - jail: Fix a race in prison_deref() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 79af745f4c29ab3df037fcf0a4b4fb1ea393825f Auto-Submitted: auto-generated Date: Fri, 25 Sep 2026 17:00:45 +0000 Message-Id: <6ab6a8bd.1e64d.5ebda459@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=79af745f4c29ab3df037fcf0a4b4fb1ea393825f commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f Author: Mark Johnston AuthorDate: 2026-09-25 15:16:24 +0000 Commit: Mark Johnston CommitDate: 2026-09-25 16:50:41 +0000 jail: Fix a race in prison_deref() If we're killing a jail which has some user refs pending, then we would first drop our ref and then kill all processes in the prison. However, it's possible for the prison to be freed before we finish that operation, generally if the processes exit on their own before prison_proc_iterate() returns. Thus, defer the release of the prison refcount until after we've killed all procs. Reviewed by: jamie MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59984 --- sys/kern/kern_jail.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 31b7c4a1e4f6..79922c3a0d38 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -3723,8 +3723,10 @@ prison_deref(struct prison *pr, int flags) * that need to be killed, either in this prison or its * descendants. */ - if (refcount_load(&pr->pr_uref) > 0) + if (refcount_load(&pr->pr_uref) > 0) { killpr = pr; + flags &= ~PD_DEREF; + } /* Make sure the parent prison doesn't get killed. */ flags &= ~PD_KILL; } @@ -3794,8 +3796,10 @@ prison_deref(struct prison *pr, int flags) sx_xunlock(&allprison_lock); /* Kill any processes attached to a killed prison. */ - if (killpr != NULL) + if (killpr != NULL) { prison_proc_iterate(killpr, prison_kill_processes_cb, NULL); + prison_free(killpr); + } /* * Finish removing any unreferenced prisons, which couldn't happen