From 2c0de3891233da4043c8ebff7f85f909289d6886 Mon Sep 17 00:00:00 2001
From: trasz <trasz@FreeBSD.org>
Date: Wed, 2 Nov 2016 09:43:19 +0000
Subject: [PATCH] Fix getfsstat(2) with MNT_WAIT to not skip filesystems that
 are in the process of being unmounted.  Previously it would skip them, even
 if the unmount eventually failed eg due to the filesystem being busy.

This behaviour broke autounmountd(8) - if you tried to manually unmount
a mounted filesystem, using 'automount -u', and the autounmountd attempted
to refresh the filesystem list in that very moment, it would conclude that
the filesystem got unmounted and not try to unmount it afterwards.

Reviewed by:	kib@
Tested by:	pho@
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D8030
---
 sys/kern/vfs_syscalls.c | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 03dc29eb8398..8b9b2cf1d62c 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -446,16 +446,19 @@ kern_getfsstat(struct thread *td, struct statfs **buf, size_t bufsize,
     size_t *countp, enum uio_seg bufseg, int flags)
 {
 	struct mount *mp, *nmp;
-	struct statfs *sfsp, *sp, sb;
+	struct statfs *sfsp, *sp, sb, *tofree;
 	size_t count, maxcount;
 	int error;
 
+restart:
 	maxcount = bufsize / sizeof(struct statfs);
-	if (bufsize == 0)
+	if (bufsize == 0) {
 		sfsp = NULL;
-	else if (bufseg == UIO_USERSPACE)
+		tofree = NULL;
+	} else if (bufseg == UIO_USERSPACE) {
 		sfsp = *buf;
-	else /* if (bufseg == UIO_SYSSPACE) */ {
+		tofree = NULL;
+	} else /* if (bufseg == UIO_SYSSPACE) */ {
 		count = 0;
 		mtx_lock(&mountlist_mtx);
 		TAILQ_FOREACH(mp, &mountlist, mnt_list) {
@@ -464,8 +467,8 @@ kern_getfsstat(struct thread *td, struct statfs **buf, size_t bufsize,
 		mtx_unlock(&mountlist_mtx);
 		if (maxcount > count)
 			maxcount = count;
-		sfsp = *buf = malloc(maxcount * sizeof(struct statfs), M_TEMP,
-		    M_WAITOK);
+		tofree = sfsp = *buf = malloc(maxcount * sizeof(struct statfs),
+		    M_TEMP, M_WAITOK);
 	}
 	count = 0;
 	mtx_lock(&mountlist_mtx);
@@ -480,9 +483,24 @@ kern_getfsstat(struct thread *td, struct statfs **buf, size_t bufsize,
 			continue;
 		}
 #endif
-		if (vfs_busy(mp, MBF_NOWAIT | MBF_MNTLSTLOCK)) {
-			nmp = TAILQ_NEXT(mp, mnt_list);
-			continue;
+		if (flags == MNT_WAIT) {
+			if (vfs_busy(mp, MBF_MNTLSTLOCK) != 0) {
+				/*
+				 * If vfs_busy() failed, and MBF_NOWAIT
+				 * wasn't passed, then the mp is gone.
+				 * Furthermore, because of MBF_MNTLSTLOCK,
+				 * the mountlist_mtx was dropped.  We have
+				 * no other choice than to start over.
+				 */
+				mtx_unlock(&mountlist_mtx);
+				free(tofree, M_TEMP);
+				goto restart;
+			}
+		} else {
+			if (vfs_busy(mp, MBF_NOWAIT | MBF_MNTLSTLOCK) != 0) {
+				nmp = TAILQ_NEXT(mp, mnt_list);
+				continue;
+			}
 		}
 		if (sfsp && count < maxcount) {
 			sp = &mp->mnt_stat;