From: Kirill A. Korinsky <kirill@korins.ky>
Subject: sys/ffs: reclaim vnode before dropping last ref
To: OpenBSD tech <tech@openbsd.org>
Date: Wed, 24 Jun 2026 10:05:45 +0200

tech@,

In ffs_vinit(), the alias path called vrele() before vgone() on the same
vnode.

Once vrele() drops the last reference, the caller no longer owns the vnode;
VFS may reclaim or reuse it.

Ok?

diff --git sys/ufs/ffs/ffs_subr.c sys/ufs/ffs/ffs_subr.c
index de81df8b619..3b38f1ec36b 100644
--- sys/ufs/ffs/ffs_subr.c
+++ sys/ufs/ffs/ffs_subr.c
@@ -243,8 +243,8 @@ ffs_vinit(struct mount *mntp, struct vnode **vpp)
 #ifdef VFSLCKDEBUG
 			vp->v_flag &= ~VLOCKSWORK;
 #endif
-			vrele(vp);
 			vgone(vp);
+			vrele(vp);
 			/*
 			 * Reinitialize aliased inode.
 			 */


-- 
wbr, Kirill