diff options
| author | riastradh <riastradh@NetBSD.org> | 2022-08-12 21:25:39 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2022-08-12 21:25:39 +0000 |
| commit | e36719e62463ec3b3bbd20d3537075e1de3a0bb5 (patch) | |
| tree | 90abb77fe68f2695ec14d5ee444d0b0526d03818 /sys/miscfs | |
| parent | eeae2d6aafc0b732a8b8ab0149bbbb7a4debe335 (diff) | |
specfs: Refuse to open a closing-in-progress block device.
We could wait for close to complete, but if this happened ever so
slightly earlier it would lead to EBUSY anyway, so there's no point
in adding logic for that -- either way the caller neglected to wait
for the last close to finish before trying to open it the device
again.
https://mail-index.netbsd.org/current-users/2022/08/09/msg042800.html
Reported-by: syzbot+4388f20706ec8a4c8db0@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=47c67ab6d3a87514d0707882a9ad6671beaa8642
Reported-by: syzbot+0f1756652dce4cb341ed@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=a632ce762d64241fc82a9bc57230b7b7c7095d1a
Diffstat (limited to 'sys/miscfs')
| -rw-r--r-- | sys/miscfs/specfs/spec_vnops.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/sys/miscfs/specfs/spec_vnops.c b/sys/miscfs/specfs/spec_vnops.c index 3c130d7abe8..caf48155a32 100644 --- a/sys/miscfs/specfs/spec_vnops.c +++ b/sys/miscfs/specfs/spec_vnops.c @@ -1,4 +1,4 @@ -/* $NetBSD: spec_vnops.c,v 1.213 2022/08/12 17:06:01 riastradh Exp $ */ +/* $NetBSD: spec_vnops.c,v 1.214 2022/08/12 21:25:39 riastradh Exp $ */ /*- * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -58,7 +58,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.213 2022/08/12 17:06:01 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.214 2022/08/12 21:25:39 riastradh Exp $"); #include <sys/param.h> #include <sys/proc.h> @@ -789,8 +789,13 @@ spec_open(void *v) * * Treat zero opencnt with non-NULL mountpoint as open. * This may happen after forced detach of a mounted device. + * + * Also treat sd_closing, meaning there is a concurrent + * close in progress, as still open. */ - if (sd->sd_opencnt != 0 || sd->sd_mountpoint != NULL) { + if (sd->sd_opencnt != 0 || + sd->sd_mountpoint != NULL || + sd->sd_closing) { error = EBUSY; break; } |
