[src/trunk]: src/sys/kern Lock the vnode while calling VOP_BMAP() for FIOGETB...

[chs <chs%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ffcfe66fc6e5
branches:  trunk
changeset: 978122:ffcfe66fc6e5
user:      chs <chs%NetBSD.org@localhost>
date:      Mon Nov 09 18:09:02 2020 +0000

description:
Lock the vnode while calling VOP_BMAP() for FIOGETBMAP.

Reported-by: syzbot+cfa1b773be7337250428%syzkaller.appspotmail.com@localhost

diffstat:

 sys/kern/vfs_vnops.c |  11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

diffs (40 lines):

diff -r 85f3d2bedecd -r ffcfe66fc6e5 sys/kern/vfs_vnops.c
--- a/sys/kern/vfs_vnops.c      Mon Nov 09 16:15:05 2020 +0000
+++ b/sys/kern/vfs_vnops.c      Mon Nov 09 18:09:02 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: vfs_vnops.c,v 1.213 2020/06/11 22:21:05 ad Exp $       */
+/*     $NetBSD: vfs_vnops.c,v 1.214 2020/11/09 18:09:02 chs Exp $      */
 
 /*-
  * Copyright (c) 2009 The NetBSD Foundation, Inc.
@@ -66,7 +66,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vfs_vnops.c,v 1.213 2020/06/11 22:21:05 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_vnops.c,v 1.214 2020/11/09 18:09:02 chs Exp $");
 
 #include "veriexec.h"
 
@@ -757,7 +757,10 @@
                        if (*(daddr_t *)data < 0)
                                return (EINVAL);
                        block = (daddr_t *)data;
-                       return (VOP_BMAP(vp, *block, NULL, block, NULL));
+                       vn_lock(vp, LK_SHARED | LK_RETRY);
+                       error = VOP_BMAP(vp, *block, NULL, block, NULL);
+                       VOP_UNLOCK(vp);
+                       return error;
                }
                if (com == OFIOGETBMAP) {
                        daddr_t ibn, obn;
@@ -765,7 +768,9 @@
                        if (*(int32_t *)data < 0)
                                return (EINVAL);
                        ibn = (daddr_t)*(int32_t *)data;
+                       vn_lock(vp, LK_SHARED | LK_RETRY);
                        error = VOP_BMAP(vp, ibn, NULL, &obn, NULL);
+                       VOP_UNLOCK(vp);
                        *(int32_t *)data = (int32_t)obn;
                        return error;
                }