- Consolidate error handling in the cd9660 and udf mount routines.

- Always read the character device pointer while the associated devfs vnode
  is locked.  Also, use dev_ref() to obtain a new reference on the vnode for
  the mountpoint.  This reference is released on unmount.  This mirrors the
  earlier fix to FFS.

Reviewed by:	kib

2 files changed, 26 insertions, 24 deletions

diff --git a/sys/fs/cd9660/cd9660_vfsops.c b/sys/fs/cd9660/cd9660_vfsops.c
index b8ec72a..e6001eb 100644
--- a/sys/fs/cd9660/cd9660_vfsops.c
+++ b/sys/fs/cd9660/cd9660_vfsops.c
@@ -203,7 +203,7 @@ iso_mountfs(devvp, mp)
 	struct iso_mnt *isomp = (struct iso_mnt *)0;
 	struct buf *bp = NULL;
 	struct buf *pribp = NULL, *supbp = NULL;
-	struct cdev *dev = devvp->v_rdev;
+	struct cdev *dev;
 	int error = EINVAL;
 	int high_sierra = 0;
 	int iso_bsize;
@@ -219,6 +219,8 @@ iso_mountfs(devvp, mp)
 	struct bufobj *bo;
 	char *cs_local, *cs_disk;
 
+	dev = devvp->v_rdev;
+	dev_ref(dev);
 	DROP_GIANT();
 	g_topology_lock();
 	error = g_vfs_open(devvp, &cp, "cd9660", 0);
@@ -226,27 +228,21 @@ iso_mountfs(devvp, mp)
 	PICKUP_GIANT();
 	VOP_UNLOCK(devvp, 0);
 	if (error)
-		return error;
+		goto out;
 	if (devvp->v_rdev->si_iosize_max != 0)
 		mp->mnt_iosize_max = devvp->v_rdev->si_iosize_max;
 	if (mp->mnt_iosize_max > MAXPHYS)
 		mp->mnt_iosize_max = MAXPHYS;
 
 	bo = &devvp->v_bufobj;
-	bo->bo_private = cp;
-	bo->bo_ops = g_vfs_bufops;
 
 	/* This is the "logical sector size".  The standard says this
 	 * should be 2048 or the physical sector size on the device,
 	 * whichever is greater.
 	 */
 	if ((ISO_DEFAULT_BLOCK_SIZE % cp->provider->sectorsize) != 0) {
-		DROP_GIANT();
-		g_topology_lock();
-		g_vfs_close(cp);
-		g_topology_unlock();
-                PICKUP_GIANT();
-		return (EINVAL);
+		error = EINVAL;
+		goto out;
 	}
 
 	iso_bsize = cp->provider->sectorsize;
@@ -485,6 +481,7 @@ out:
 		free((caddr_t)isomp, M_ISOFSMNT);
 		mp->mnt_data = NULL;
 	}
+	dev_rel(dev);
 	return error;
 }
 
@@ -519,6 +516,7 @@ cd9660_unmount(mp, mntflags, td)
 	g_topology_unlock();
 	PICKUP_GIANT();
 	vrele(isomp->im_devvp);
+	dev_rel(isomp->im_dev);
 	free((caddr_t)isomp, M_ISOFSMNT);
 	mp->mnt_data = NULL;
 	MNT_ILOCK(mp);
diff --git a/sys/fs/udf/udf_vfsops.c b/sys/fs/udf/udf_vfsops.c
index 3d3b86d..d731918 100644
--- a/sys/fs/udf/udf_vfsops.c
+++ b/sys/fs/udf/udf_vfsops.c
@@ -301,8 +301,10 @@ udf_checktag(struct desc_tag *tag, uint16_t id)
 }
 
 static int
-udf_mountfs(struct vnode *devvp, struct mount *mp) {
+udf_mountfs(struct vnode *devvp, struct mount *mp)
+{
 	struct buf *bp = NULL;
+	struct cdev *dev;
 	struct anchor_vdp avdp;
 	struct udf_mnt *udfmp = NULL;
 	struct part_desc *pd;
@@ -319,6 +321,8 @@ udf_mountfs(struct vnode *devvp, struct mount *mp) {
 	struct g_consumer *cp;
 	struct bufobj *bo;
 
+	dev = devvp->v_rdev;
+	dev_ref(dev);
 	DROP_GIANT();
 	g_topology_lock();
 	error = g_vfs_open(devvp, &cp, "udf", 0);
@@ -326,7 +330,7 @@ udf_mountfs(struct vnode *devvp, struct mount *mp) {
 	PICKUP_GIANT();
 	VOP_UNLOCK(devvp, 0);
 	if (error)
-		return error;
+		goto bail;
 
 	bo = &devvp->v_bufobj;
 
@@ -347,7 +351,7 @@ udf_mountfs(struct vnode *devvp, struct mount *mp) {
 	mp->mnt_kern_flag |= MNTK_MPSAFE | MNTK_LOOKUP_SHARED;
 	MNT_IUNLOCK(mp);
 	udfmp->im_mountp = mp;
-	udfmp->im_dev = devvp->v_rdev;
+	udfmp->im_dev = dev;
 	udfmp->im_devvp = devvp;
 	udfmp->im_d2l = NULL;
 	udfmp->im_cp = cp;
@@ -364,12 +368,8 @@ udf_mountfs(struct vnode *devvp, struct mount *mp) {
 
 	if (((logical_secsize % cp->provider->sectorsize) != 0) ||
 	    (logical_secsize < cp->provider->sectorsize)) {
-		DROP_GIANT();
-		g_topology_lock();
-		g_vfs_close(cp);
-		g_topology_unlock();
-		PICKUP_GIANT();
-		return (EINVAL);
+		error = EINVAL;
+		goto bail;
 	}
 
 	bsize = cp->provider->sectorsize;
@@ -492,11 +492,14 @@ bail:
 		free(udfmp, M_UDFMOUNT);
 	if (bp != NULL)
 		brelse(bp);
-	DROP_GIANT();
-	g_topology_lock();
-	g_vfs_close(cp);
-	g_topology_unlock();
-	PICKUP_GIANT();
+	if (cp != NULL) {
+		DROP_GIANT();
+		g_topology_lock();
+		g_vfs_close(cp);
+		g_topology_unlock();
+		PICKUP_GIANT();
+	}
+	dev_rel(dev);
 	return error;
 };
 
@@ -529,6 +532,7 @@ udf_unmount(struct mount *mp, int mntflags, struct thread *td)
 	g_topology_unlock();
 	PICKUP_GIANT();
 	vrele(udfmp->im_devvp);
+	dev_rel(udfmp->im_dev);
 
 	if (udfmp->s_table != NULL)
 		free(udfmp->s_table, M_UDFMOUNT);