Created attachment 243757 [details] a gzipped cd9660 image that causes bread() to be called w/o brelse() cd9660_rrip_loop() in sys/fs/cd9660/cd9660_rrip.c says: while (1) { ...; || bread(ana->imp->im_devvp, ana->iso_ce_blk << (ana->imp->im_bshift - DEV_BSHIFT), ana->imp->logical_block_size, NOCRED, &bp)) ...; } if (bp) brelse(bp); The brelse(bp) is outside the loop; if the loop bread()s twice, a block is left locked. I've attached a demo image: # gunzip cd7a.iso.gz # mdconfig cd7a.iso # mount_cd9660 /dev/md0 /mnt panic: userret: Returning with 1 locks held panic() at panic+0x26 userret() at userret+0xf4 syscallret() at syscallret+0xa0 ecall_handler() at ecall_handler+0x22 do_trap_user() at do_trap_user+0xf2 cpu_exception_handler_user() at cpu_exception_handler_user+0x72 --- syscall (378, FreeBSD ELF64, nmount)
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=fa3cf6cdc68cb6d6f2c440f2653258d68eae1015 commit fa3cf6cdc68cb6d6f2c440f2653258d68eae1015 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-07-31 22:55:13 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-07-31 22:55:13 +0000 cd9660: do not leak buffers in cd9660_rrip_loop() Reported by: Robert Morris <rtm@lcs.mit.edu> PR: 272856 Sponsored by: The FreeBSD Foundation MFC after: 1 week sys/fs/cd9660/cd9660_rrip.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=746c8f0cd7061bcda4bb68cb612827288459bee6 commit 746c8f0cd7061bcda4bb68cb612827288459bee6 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-07-31 22:55:13 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-08-07 00:48:45 +0000 cd9660: do not leak buffers in cd9660_rrip_loop() PR: 272856 (cherry picked from commit fa3cf6cdc68cb6d6f2c440f2653258d68eae1015) sys/fs/cd9660/cd9660_rrip.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
A commit in branch stable/12 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=2030f99a9aac92b06e16f0f21a3307df8ee90acd commit 2030f99a9aac92b06e16f0f21a3307df8ee90acd Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-07-31 22:55:13 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2023-08-08 18:12:29 +0000 cd9660: do not leak buffers in cd9660_rrip_loop() PR: 272856 (cherry picked from commit fa3cf6cdc68cb6d6f2c440f2653258d68eae1015) (cherry picked from commit 746c8f0cd7061bcda4bb68cb612827288459bee6) sys/fs/cd9660/cd9660_rrip.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)