Use "fip->fi_readers == 0 && fip->fi_writers == 0" as the condition for

disposing fifo resources in fifo_cleanup() instead using of
"vp->v_usecount == 1".  There may be other references to the vnode, for
instance by nullfs, at the time fifo_open() or fifo_close() is called,
which could cause a resource leak.

Don't bother grabbing the vnode interlock in fifo_cleanup() since it no
longer accesses v_usecount.

1 files changed, 3 insertions, 6 deletions

diff --git a/sys/fs/fifofs/fifo_vnops.c b/sys/fs/fifofs/fifo_vnops.c
index 36f8357..e7112d0 100644
--- a/sys/fs/fifofs/fifo_vnops.c
+++ b/sys/fs/fifofs/fifo_vnops.c
@@ -155,22 +155,19 @@ fifo_lookup(ap)
 
 /*
  * Dispose of fifo resources.
- * Should be called with vnode locked
  */
 static void
 fifo_cleanup(struct vnode *vp)
 {
 	struct fifoinfo *fip = vp->v_fifoinfo;
 
-	VI_LOCK(vp);
-	if (vp->v_usecount == 1) {
+	ASSERT_VOP_LOCKED(vp, "fifo_cleanup");
+	if (fip->fi_readers == 0 && fip->fi_writers == 0) {
 		vp->v_fifoinfo = NULL;
-		VI_UNLOCK(vp);
 		(void)soclose(fip->fi_readsock);
 		(void)soclose(fip->fi_writesock);
 		FREE(fip, M_VNODE);
-	} else
-		VI_UNLOCK(vp);
+	}
 }
 
 /*