Skip to content

zfs_vnops_os.c: Move a vput() to after zfs_setattr_dir()#18188

Open
rmacklem wants to merge 1 commit intoopenzfs:masterfrom
rmacklem:master
Open

zfs_vnops_os.c: Move a vput() to after zfs_setattr_dir()#18188
rmacklem wants to merge 1 commit intoopenzfs:masterfrom
rmacklem:master

Conversation

@rmacklem
Copy link
Contributor

@rmacklem rmacklem commented Feb 8, 2026

Without this patch, the following crash can occur when a file system is configured with "xattr=dir".

VNASSERT failed: locked not true at /posix-acl/freebsd-rdma/sys/kern/vfs_subr.c:5786 (assert_vop_locked) 0xfffff8001cc29370: type VDIR state VSTATE_CONSTRUCTED op 0xffffffff82fb2158
usecount 0, writecount 0, refcount 0 seqc users 0 mountedhere 0
hold count flags ()
flags ()
lock type zfs: UNLOCKED
panic: zfs_dirent_lookup: vnode is not locked but should be cpuid = 3
time = 1770520763
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00914c8140 vpanic() at vpanic+0x136/frame 0xfffffe00914c8270
panic() at panic+0x43/frame 0xfffffe00914c82d0
assert_vop_locked() at assert_vop_locked+0x78/frame 0xfffffe00914c82f0 zfs_dirent_lookup() at zfs_dirent_lookup+0x41/frame 0xfffffe00914c8340 zfs_setattr_dir() at zfs_setattr_dir+0x123/frame 0xfffffe00914c84a0 zfs_setattr() at zfs_setattr+0x1389/frame 0xfffffe00914c89e0 zfs_freebsd_setattr() at zfs_freebsd_setattr+0x56b/frame 0xfffffe00914c8b80 VOP_SETATTR_APV() at VOP_SETATTR_APV+0x5d/frame 0xfffffe00914c8bb0 setfown() at setfown+0xb1/frame 0xfffffe00914c8cc0 kern_fchownat() at kern_fchownat+0x192/frame 0xfffffe00914c8de0

This patch fixes the problem by moving the vput() call for attrzp to after the zfs_setattr_dir() call that takes it as an argument.

This was tested on a FreeBSD system with/without the patch by running a little
program that does the following (the file system is configured xattr=dir and "foo"
has a named attribute associated with it.

fd = open("foo", O_RDONLY | O_NOFOLLOW | O_PATH, 0);
fchownat(fd, "", 1001, 1001, AT_EMPTY_PATH);

Without the patch the above syscalls cause the crash.
With the patch, the above syscalls perform correctly.

Types of changes

  • [x ] Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Quality assurance (non-breaking change which makes the code more robust against bugs)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

  • [x ] My code follows the OpenZFS code style requirements.
  • I have updated the documentation accordingly.
  • [x ] I have read the contributing document.
  • I have added tests to cover my changes.
  • I have run the ZFS Test Suite with this change applied.
  • [x ] All commit messages are properly formatted and contain Signed-off-by.

Without this patch, the following crash can occur when
a file system is configured with "xattr=dir".

VNASSERT failed: locked not true at
 /posix-acl/freebsd-rdma/sys/kern/vfs_subr.c:5786 (assert_vop_locked)
    hold count flags ()
    flags ()
    lock type zfs: UNLOCKED
panic: zfs_dirent_lookup: vnode is not locked but should be
cpuid = 3
time = 1770520763
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b
vpanic() at vpanic+0x136/frame 0xfffffe00914c8270
panic() at panic+0x43/frame 0xfffffe00914c82d0
assert_vop_locked() at assert_vop_locked+0x78
zfs_dirent_lookup() at zfs_dirent_lookup+0x41
zfs_setattr_dir() at zfs_setattr_dir+0x123
zfs_setattr() at zfs_setattr+0x1389
zfs_freebsd_setattr() at zfs_freebsd_setattr+0x56b
VOP_SETATTR_APV() at VOP_SETATTR_APV+0x5d
setfown() at setfown+0xb1
kern_fchownat() at kern_fchownat+0x192

This patch fixes the problem by moving the vput() call for
attrzp to after the zfs_setattr_dir() call that takes it as
an argument.

Signed-off-by: Rick Macklem <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant