From 618baf4714471cc3fb5fab3d4269d35a9a8ade41 Mon Sep 17 00:00:00 2001
From: kan <kan@FreeBSD.org>
Date: Sun, 2 Nov 2003 04:52:53 +0000
Subject: [PATCH] Take care not to call vput if thread used in corresponding
 vget wasn't curthread, i.e. when we receive a thread pointer to use as a
 function argument. Use VOP_UNLOCK/vrele in these cases.

The only case there td != curthread known at the moment is
boot() calling sync with thread0 pointer.

This fixes the panic on shutdown people have reported.
---
 sys/fs/msdosfs/msdosfs_vfsops.c | 3 ++-
 sys/gnu/ext2fs/ext2_vfsops.c    | 3 ++-
 sys/gnu/fs/ext2fs/ext2_vfsops.c | 3 ++-
 sys/kern/vfs_default.c          | 3 ++-
 sys/nfsclient/nfs_vfsops.c      | 3 ++-
 sys/ufs/ffs/ffs_vfsops.c        | 6 ++++--
 sys/ufs/ufs/ufs_quota.c         | 9 ++++++---
 7 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/sys/fs/msdosfs/msdosfs_vfsops.c b/sys/fs/msdosfs/msdosfs_vfsops.c
index 21bd2bc85a91..fc0e35426102 100644
--- a/sys/fs/msdosfs/msdosfs_vfsops.c
+++ b/sys/fs/msdosfs/msdosfs_vfsops.c
@@ -814,7 +814,8 @@ msdosfs_sync(mp, waitfor, cred, td)
 		error = VOP_FSYNC(vp, cred, waitfor, td);
 		if (error)
 			allerror = error;
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 	}
 	mtx_unlock(&mntvnode_mtx);
diff --git a/sys/gnu/ext2fs/ext2_vfsops.c b/sys/gnu/ext2fs/ext2_vfsops.c
index a9c4160ad7ce..c9544c163988 100644
--- a/sys/gnu/ext2fs/ext2_vfsops.c
+++ b/sys/gnu/ext2fs/ext2_vfsops.c
@@ -933,7 +933,8 @@ ext2_sync(mp, waitfor, cred, td)
 		}
 		if ((error = VOP_FSYNC(vp, cred, waitfor, td)) != 0)
 			allerror = error;
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 	}
 	mtx_unlock(&mntvnode_mtx);
diff --git a/sys/gnu/fs/ext2fs/ext2_vfsops.c b/sys/gnu/fs/ext2fs/ext2_vfsops.c
index a9c4160ad7ce..c9544c163988 100644
--- a/sys/gnu/fs/ext2fs/ext2_vfsops.c
+++ b/sys/gnu/fs/ext2fs/ext2_vfsops.c
@@ -933,7 +933,8 @@ ext2_sync(mp, waitfor, cred, td)
 		}
 		if ((error = VOP_FSYNC(vp, cred, waitfor, td)) != 0)
 			allerror = error;
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 	}
 	mtx_unlock(&mntvnode_mtx);
diff --git a/sys/kern/vfs_default.c b/sys/kern/vfs_default.c
index 4e248c1a49bc..ffce8ff0adf8 100644
--- a/sys/kern/vfs_default.c
+++ b/sys/kern/vfs_default.c
@@ -908,7 +908,8 @@ vfs_stdsync(mp, waitfor, cred, td)
 		if (error)
 			allerror = error;
 
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 	}
 	mtx_unlock(&mntvnode_mtx);
diff --git a/sys/nfsclient/nfs_vfsops.c b/sys/nfsclient/nfs_vfsops.c
index 880d2b144eac..3df0fa301334 100644
--- a/sys/nfsclient/nfs_vfsops.c
+++ b/sys/nfsclient/nfs_vfsops.c
@@ -958,7 +958,8 @@ nfs_sync(struct mount *mp, int waitfor, struct ucred *cred, struct thread *td)
 		error = VOP_FSYNC(vp, cred, waitfor, td);
 		if (error)
 			allerror = error;
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 	}
 	mtx_unlock(&mntvnode_mtx);
diff --git a/sys/ufs/ffs/ffs_vfsops.c b/sys/ufs/ffs/ffs_vfsops.c
index 40839aace66d..4e6d0ea00331 100644
--- a/sys/ufs/ffs/ffs_vfsops.c
+++ b/sys/ufs/ffs/ffs_vfsops.c
@@ -537,7 +537,8 @@ ffs_reload(mp, cred, td)
 		ffs_load_inode(bp, ip, fs, ip->i_number);
 		ip->i_effnlink = ip->i_nlink;
 		brelse(bp);
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 	}
 	mtx_unlock(&mntvnode_mtx);
@@ -1166,7 +1167,8 @@ ffs_sync(mp, waitfor, cred, td)
 		}
 		if ((error = VOP_FSYNC(vp, cred, waitfor, td)) != 0)
 			allerror = error;
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 		if (TAILQ_NEXT(vp, v_nmntvnodes) != nvp)
 			goto loop;
diff --git a/sys/ufs/ufs/ufs_quota.c b/sys/ufs/ufs/ufs_quota.c
index d34f148188a0..11f4fb2eb4c6 100644
--- a/sys/ufs/ufs/ufs_quota.c
+++ b/sys/ufs/ufs/ufs_quota.c
@@ -468,12 +468,14 @@ quotaon(td, mp, type, fname)
 			goto again;
 		}
 		if (vp->v_type == VNON || vp->v_writecount == 0) {
-			vput(vp);
+			VOP_UNLOCK(vp, 0, td);
+			vrele(vp);
 			mtx_lock(&mntvnode_mtx);
 			continue;
 		}
 		error = getinoquota(VTOI(vp));
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 		if (error)
 			break;
@@ -536,7 +538,8 @@ quotaoff(td, mp, type)
 		dq = ip->i_dquot[type];
 		ip->i_dquot[type] = NODQUOT;
 		dqrele(vp, dq);
-		vput(vp);
+		VOP_UNLOCK(vp, 0, td);
+		vrele(vp);
 		mtx_lock(&mntvnode_mtx);
 		if (TAILQ_NEXT(vp, v_nmntvnodes) != nextvp)
 			goto again;