- Release the references acquired by VOP_GETWRITEMOUNT and vfs_getvfs().

Discussed with:	tegge
Tested by:	kris
Sponsored by:	Isilon Systems, Inc.

2 files changed, 15 insertions, 2 deletions

diff --git a/sys/nfsserver/nfs_serv.c b/sys/nfsserver/nfs_serv.c
index f7597e4..3b8285f 100644
--- a/sys/nfsserver/nfs_serv.c
+++ b/sys/nfsserver/nfs_serv.c
@@ -338,6 +338,7 @@ nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	VATTR_NULL(vap);
@@ -1103,6 +1104,7 @@ nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mntp, V_WAIT);
+	vfs_rel(mntp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	if (v3) {
@@ -1754,6 +1756,7 @@ nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -2058,6 +2061,7 @@ nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -2260,6 +2264,7 @@ nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -2394,6 +2399,7 @@ nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -2637,6 +2643,7 @@ nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvmtofh(dfhp);
@@ -2801,6 +2808,7 @@ nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -2991,6 +2999,7 @@ nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -3164,6 +3173,7 @@ nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	nfsm_srvnamesiz(len);
@@ -4024,6 +4034,7 @@ nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 	NFSD_UNLOCK();
 	mtx_lock(&Giant);	/* VFS */
 	(void) vn_start_write(NULL, &mp, V_WAIT);
+	vfs_rel(mp);		/* The write holds a ref. */
 	mtx_unlock(&Giant);	/* VFS */
 	NFSD_LOCK();
 	tl = nfsm_dissect_nonblock(u_int32_t *, 3 * NFSX_UNSIGNED);
diff --git a/sys/nfsserver/nfs_srvsubs.c b/sys/nfsserver/nfs_srvsubs.c
index 1aa976a..375a1d2 100644
--- a/sys/nfsserver/nfs_srvsubs.c
+++ b/sys/nfsserver/nfs_srvsubs.c
@@ -1069,6 +1069,7 @@ nfsrv_fhtovp(fhandle_t *fhp, int lockflag, struct vnode **vpp,
 	int i;
 	struct ucred *credanon;
 	int error, exflags;
+	int vfslocked;
 #ifdef MNT_EXNORESPORT		/* XXX needs mountd and /etc/exports help yet */
 	struct sockaddr_int *saddr;
 #endif
@@ -1087,7 +1088,7 @@ nfsrv_fhtovp(fhandle_t *fhp, int lockflag, struct vnode **vpp,
 	if (!mp)
 		return (ESTALE);
 	NFSD_UNLOCK();
-	mtx_lock(&Giant);	/* VFS */
+	vfslocked = VFS_LOCK_GIANT(mp);
 	error = VFS_CHECKEXP(mp, nam, &exflags, &credanon);
 	if (error)
 		goto out;
@@ -1124,7 +1125,8 @@ nfsrv_fhtovp(fhandle_t *fhp, int lockflag, struct vnode **vpp,
 	if (!lockflag)
 		VOP_UNLOCK(*vpp, 0, td);
 out:
-	mtx_unlock(&Giant);	/* VFS */
+	vfs_rel(mp);
+	VFS_UNLOCK_GIANT(vfslocked);
 	NFSD_LOCK();
 	return (error);
 }