freebsd-dev/sys/fs/nullfs
Konstantin Belousov 5fc9e11c42 Save lower root vnode in nullfs mnt data instead of upper.
Nullfs needs to know the root vnode of the lower fs during the
operation.  Currently it caches the upper vnode of it, which is also
the root of the nullfs mount.  On unmount, nullfs calls vflush() with
rootrefs == 1, and aborts non-forced unmount if there are any more
vnodes instantiated during vflush().  This means that the reference to
the root vnode after failed non-forced unmount could be lost and
nullm_rootvp points to the freed memory.

Fix it by storing the reference for lower vnode instead, which is kept
intact during vflush().  nullfs_root() now instantiates the upper
vnode of lower root.  Care about VV_ROOT flag in null_nodeget().

Reported and tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2020-01-28 11:29:06 +00:00
..
null_subr.c Save lower root vnode in nullfs mnt data instead of upper. 2020-01-28 11:29:06 +00:00
null_vfsops.c Save lower root vnode in nullfs mnt data instead of upper. 2020-01-28 11:29:06 +00:00
null_vnops.c vfs: drop the mostly unused flags argument from VOP_UNLOCK 2020-01-03 22:29:58 +00:00
null.h Save lower root vnode in nullfs mnt data instead of upper. 2020-01-28 11:29:06 +00:00