[DragonFlyBSD - Bug #3386] panic when umounting devfs inside jail

[sigttou]

Issue #3386 has been updated by sigttou.

File jail-unmount-userptr-master.patch added

sys_unmount() printed the "does not belong to this jail" message using
uap->path, a user-space pointer:

<pre>
kprintf("mountpoint %s does not belong to this jail\n", uap->path);
</pre>

With SMAP enabled, kprintf() -> strlen() faults on the user address, so
only "mountpoint " is printed before the panic.

Fix: use nd.nl_path, the kernel copy that nlookup_init() already made.


----------------------------------------
Bug #3386: panic when umounting devfs inside jail
http://bugs.dragonflybsd.org/issues/3386#change-14710

* Author: liweitianux
* Status: New
* Priority: Normal
* Target version: 6.6
* Start date: 2025-08-28
----------------------------------------
tuxillo reported this panic on 2025-03-17:

<pre>
mountpoint panic with 1 spinlocks held
panic: page fault
cpuid = 0
Trace beginning at frame 0xfffff806c2d854c8
trap_fatal() at trap_fatal+0x301 0xffffffff80be6281
trap_fatal() at trap_fatal+0x301 0xffffffff80be6281
trap_pfault() at trap_pfault+0x431 0xffffffff80be6861
trap() at trap+0x17c 0xffffffff80be6dcc
calltrap() at calltrap+0x9 0xffffffff80baa4ba
</pre>

tuxillo› just mounted devfs inside a jail, tried to unmount it, boom

---Files--------------------------------
jail-unmount-userptr-master.patch (1.03 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account