svn commit: r357306 - head/sys/fs/nullfs

[Konstantin Belousov]

Author: kib
Date: Thu Jan 30 19:34:37 2020
New Revision: 357306
URL: https://svnweb.freebsd.org/changeset/base/357306

Log:
  Fix a bug in r357199.
  
  Around a generic call to null_nodeget(), there is nothing that would
  prevent the unmount of the nullfs mp until we process to the
  insmntque1() point.  Calculate the VV_ROOT flag after insmntque1() to
  not access mp->mnt_data before we have an exclusively locked vnode
  from this mount point on the mp vnode list.
  
  Reported and tested by:	pho
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week

Modified:
  head/sys/fs/nullfs/null_subr.c

Modified: head/sys/fs/nullfs/null_subr.c
==============================================================================
--- head/sys/fs/nullfs/null_subr.c	Thu Jan 30 19:15:27 2020	(r357305)
+++ head/sys/fs/nullfs/null_subr.c	Thu Jan 30 19:34:37 2020	(r357306)
@@ -252,11 +252,12 @@ null_nodeget(mp, lowervp, vpp)
 	vp->v_type = lowervp->v_type;
 	vp->v_data = xp;
 	vp->v_vnlock = lowervp->v_vnlock;
-	if (lowervp == MOUNTTONULLMOUNT(mp)->nullm_lowerrootvp)
-		vp->v_vflag |= VV_ROOT;
 	error = insmntque1(vp, mp, null_insmntque_dtr, xp);
 	if (error != 0)
 		return (error);
+	if (lowervp == MOUNTTONULLMOUNT(mp)->nullm_lowerrootvp)
+		vp->v_vflag |= VV_ROOT;
+
 	/*
 	 * Atomically insert our new node into the hash or vget existing 
 	 * if someone else has beaten us to it.