git: c4585660d2bf - stable/13 - mntfs: lock mntfs pseudo devfs vnode properly

The branch stable/13 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=c4585660d2bf58de2f32a19885e1d98bfd835439

commit c4585660d2bf58de2f32a19885e1d98bfd835439
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2021-11-01 12:28:32 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2021-11-19 04:25:28 +0000

    mntfs: lock mntfs pseudo devfs vnode properly
    
    (cherry picked from commit 25809a018db3c9f3be838c10576d2bb070cc055a)
---
 sys/fs/mntfs/mntfs_vnops.c | 4 ++--
 sys/ufs/ffs/ffs_vfsops.c   | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sys/fs/mntfs/mntfs_vnops.c b/sys/fs/mntfs/mntfs_vnops.c
index 2708bc5d319f..4eb12a679590 100644
--- a/sys/fs/mntfs/mntfs_vnops.c
+++ b/sys/fs/mntfs/mntfs_vnops.c
@@ -89,7 +89,7 @@ mntfs_allocvp(struct mount *mp, struct vnode *ovp)
 void
 mntfs_freevp(struct vnode *vp)
 {
-
+	ASSERT_VOP_ELOCKED(vp, "mntfs_freevp");
 	vgone(vp);
-	vrele(vp);
+	vput(vp);
 }
diff --git a/sys/ufs/ffs/ffs_vfsops.c b/sys/ufs/ffs/ffs_vfsops.c
index b8f7c3821bf7..8d0d00bb0231 100644
--- a/sys/ufs/ffs/ffs_vfsops.c
+++ b/sys/ufs/ffs/ffs_vfsops.c
@@ -956,6 +956,7 @@ ffs_mountfs(odevvp, mp, td)
 
 	devvp = mntfs_allocvp(mp, odevvp);
 	VOP_UNLOCK(odevvp);
+	vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);
 	KASSERT(devvp->v_type == VCHR, ("reclaimed devvp"));
 	dev = devvp->v_rdev;
 	KASSERT(dev->si_snapdata == NULL, ("non-NULL snapshot data"));
@@ -977,6 +978,7 @@ ffs_mountfs(odevvp, mp, td)
 	BO_LOCK(&odevvp->v_bufobj);
 	odevvp->v_bufobj.bo_flag |= BO_NOBUFS;
 	BO_UNLOCK(&odevvp->v_bufobj);
+	VOP_UNLOCK(devvp);
 	if (dev->si_iosize_max != 0)
 		mp->mnt_iosize_max = dev->si_iosize_max;
 	if (mp->mnt_iosize_max > maxphys)
@@ -1264,6 +1266,7 @@ out:
 	odevvp->v_bufobj.bo_flag &= ~BO_NOBUFS;
 	BO_UNLOCK(&odevvp->v_bufobj);
 	atomic_store_rel_ptr((uintptr_t *)&dev->si_mountpt, 0);
+	vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);
 	mntfs_freevp(devvp);
 	dev_rel(dev);
 	return (error);
@@ -1466,6 +1469,7 @@ ffs_unmount(mp, mntflags)
 	ump->um_odevvp->v_bufobj.bo_flag &= ~BO_NOBUFS;
 	BO_UNLOCK(&ump->um_odevvp->v_bufobj);
 	atomic_store_rel_ptr((uintptr_t *)&ump->um_dev->si_mountpt, 0);
+	vn_lock(ump->um_devvp, LK_EXCLUSIVE | LK_RETRY);
 	mntfs_freevp(ump->um_devvp);
 	vrele(ump->um_odevvp);
 	dev_rel(ump->um_dev);