On Wed, Jun 24, 2026 at 10:05:45AM +0200, Kirill A. Korinsky wrote:
> tech@,
> 
> In ffs_vinit(), the alias path called vrele() before vgone() on the same
> vnode.
> 
> Once vrele() drops the last reference, the caller no longer owns the vnode;
> VFS may reclaim or reuse it.

Is this code supposed to be runnable w/o kernel lock?

> Ok?

There's a lot more of call sites with the same vrele->vgone sequence.

> diff --git sys/ufs/ffs/ffs_subr.c sys/ufs/ffs/ffs_subr.c
> index de81df8b619..3b38f1ec36b 100644
> --- sys/ufs/ffs/ffs_subr.c
> +++ sys/ufs/ffs/ffs_subr.c
> @@ -243,8 +243,8 @@ ffs_vinit(struct mount *mntp, struct vnode **vpp)
>  #ifdef VFSLCKDEBUG
>  			vp->v_flag &= ~VLOCKSWORK;
>  #endif
> -			vrele(vp);
>  			vgone(vp);
> +			vrele(vp);
>  			/*
>  			 * Reinitialize aliased inode.
>  			 */
> 
> 
> -- 
> wbr, Kirill
> 

-- 
jca