Do the vput() for the lowervp in the null_nodeget() for error case too.

Several callers of null_nodeget() did the cleanup itself, but several
missed it, most prominent being null_bypass(). Remove the cleanup from
the callers, now null_nodeget() handles lowervp free itself.

Reported and tested by:	pho
MFC after:	1 week

3 files changed, 6 insertions, 8 deletions

diff --git a/sys/fs/nullfs/null_subr.c b/sys/fs/nullfs/null_subr.c
index 5af3971..7441fce 100644
--- a/sys/fs/nullfs/null_subr.c
+++ b/sys/fs/nullfs/null_subr.c
@@ -171,6 +171,8 @@ null_hashins(mp, xp)
 static void
 null_insmntque_dtr(struct vnode *vp, void *xp)
 {
+
+	vput(((struct null_node *)xp)->null_lowervp);
 	vp->v_data = NULL;
 	vp->v_vnlock = &vp->v_lock;
 	free(xp, M_NULLFSNODE);
@@ -226,6 +228,7 @@ null_nodeget(mp, lowervp, vpp)
 
 	error = getnewvnode("null", mp, &null_vnodeops, &vp);
 	if (error) {
+		vput(lowervp);
 		free(xp, M_NULLFSNODE);
 		return (error);
 	}
diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c
index 8c00f87..cf3176f 100644
--- a/sys/fs/nullfs/null_vfsops.c
+++ b/sys/fs/nullfs/null_vfsops.c
@@ -157,8 +157,7 @@ nullfs_mount(struct mount *mp)
 	 * Make sure the node alias worked
 	 */
 	if (error) {
-		vrele(lowerrootvp);
-		free(xmp, M_NULLFSMNT);	/* XXX */
+		free(xmp, M_NULLFSMNT);
 		return (error);
 	}
 
diff --git a/sys/fs/nullfs/null_vnops.c b/sys/fs/nullfs/null_vnops.c
index bcf8750..e0645bd 100644
--- a/sys/fs/nullfs/null_vnops.c
+++ b/sys/fs/nullfs/null_vnops.c
@@ -365,9 +365,7 @@ null_lookup(struct vop_lookup_args *ap)
 			vrele(lvp);
 		} else {
 			error = null_nodeget(dvp->v_mount, lvp, &vp);
-			if (error)
-				vput(lvp);
-			else
+			if (error == 0)
 				*ap->a_vpp = vp;
 		}
 	}
@@ -809,9 +807,7 @@ null_vptocnp(struct vop_vptocnp_args *ap)
 		NULLVPTOLOWERVP(*dvp);
 #endif
 		VOP_UNLOCK(*dvp, 0); /* keep reference on *dvp */
-	} else
-		vput(ldvp);
-
+	}
 	vn_lock(vp, locked | LK_RETRY);
 	return (error);
 }