From d999ab7de20fe39e71d4745a4a3024e48ac8421d Mon Sep 17 00:00:00 2001 From: Matheus Date: Wed, 7 Oct 2026 13:21:52 -0300 Subject: [PATCH] mm: fix NULL deref on vnode inactive An oversight on vnode inactivation when the last reference was a dirty page causes a NULL-deref due to VOP_RELEASE set-NULL behavior. Use a temporary variable in this case as the backing can still be accesed by a truncation on vnode inactive. --- kernel-src/mm/cache.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel-src/mm/cache.c b/kernel-src/mm/cache.c index 45492ef4..e4b68633 100644 --- a/kernel-src/mm/cache.c +++ b/kernel-src/mm/cache.c @@ -315,6 +315,7 @@ static int sync_page(page_t *page, bool backing_lock) { page->flags &= ~PAGE_FLAGS_DIRTY; RELEASE_LOCK(); int e = 0; + vnode_t *backing = page->backing; if ((page->flags & PAGE_FLAGS_TRUNCATED) == 0) { if (backing_lock) VOP_LOCK(page->backing); @@ -323,11 +324,11 @@ static int sync_page(page_t *page, bool backing_lock) { if (backing_lock) VOP_UNLOCK(page->backing); - VOP_RELEASE(page->backing); + VOP_RELEASE(backing); } else { // page got truncated from the file while waiting to be written to disk // its still holding a reference to the vnode, so release that - VOP_RELEASE(page->backing); + VOP_RELEASE(backing); } mm_release_page(mm_get_page_address((page_t *)page));