Fix some bugs in the previous revision (1.419). Don't perform extra

vfs_rel() on the mountpoint if the MAC checks fail in kern_statfs() and
kern_fstatfs().  Similarly, don't perform an extra vfs_rel() if we get
a doomed vnode in kern_fstatfs(), and handle the case of mp being NULL
(for some doomed vnodes) by conditionalizing the vfs_rel() in
kern_fstatfs() on mp != NULL.

CID:		1517
Found by:	Coverity Prevent (tm) (kern_fstatfs())
Pointy hat to:	jhb

1 files changed, 4 insertions, 9 deletions

diff --git a/sys/kern/vfs_extattr.c b/sys/kern/vfs_extattr.c
index 6fd2c28..15afddc 100644
--- a/sys/kern/vfs_extattr.c
+++ b/sys/kern/vfs_extattr.c
@@ -253,10 +253,8 @@ kern_statfs(struct thread *td, char *path, enum uio_seg pathseg,
 	vput(nd.ni_vp);
 #ifdef MAC
 	error = mac_check_mount_stat(td->td_ucred, mp);
-	if (error) {
-		vfs_rel(mp);
+	if (error)
 		goto out;
-	}
 #endif
 	/*
 	 * Set these in case the underlying filesystem fails to do so.
@@ -335,17 +333,13 @@ kern_fstatfs(struct thread *td, int fd, struct statfs *buf)
 	VOP_UNLOCK(vp, 0, td);
 	fdrop(fp, td);
 	if (vp->v_iflag & VI_DOOMED) {
-		if (mp)
-			vfs_rel(mp);
 		error = EBADF;
 		goto out;
 	}
 #ifdef MAC
 	error = mac_check_mount_stat(td->td_ucred, mp);
-	if (error) {
-		vfs_rel(mp);
+	if (error)
 		goto out;
-	}
 #endif
 	/*
 	 * Set these in case the underlying filesystem fails to do so.
@@ -365,7 +359,8 @@ kern_fstatfs(struct thread *td, int fd, struct statfs *buf)
 	}
 	*buf = *sp;
 out:
-	vfs_rel(mp);
+	if (mp)
+		vfs_rel(mp);
 	VFS_UNLOCK_GIANT(vfslocked);
 	return (error);
 }