[src/trunk]: src/sys/kern fix locking order mountlist_lock -> mnt_unmounting.

[mlelstv <mlelstv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a541f84d7f0a
branches:  trunk
changeset: 786456:a541f84d7f0a
user:      mlelstv <mlelstv%NetBSD.org@localhost>
date:      Sun Apr 28 21:34:31 2013 +0000

description:
fix locking order mountlist_lock -> mnt_unmounting.
Set IMNT_GONE early to protect against concurrent dounmount()
and vfs_busy() before the mountpoint is removed from
mount list.

diffstat:

 sys/kern/vfs_mount.c |  19 +++++++++++++++----
 1 files changed, 15 insertions(+), 4 deletions(-)

diffs (50 lines):

diff -r 03b54549ce52 -r a541f84d7f0a sys/kern/vfs_mount.c
--- a/sys/kern/vfs_mount.c      Sun Apr 28 21:07:36 2013 +0000
+++ b/sys/kern/vfs_mount.c      Sun Apr 28 21:34:31 2013 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: vfs_mount.c,v 1.18 2013/04/26 22:27:16 mlelstv Exp $   */
+/*     $NetBSD: vfs_mount.c,v 1.19 2013/04/28 21:34:31 mlelstv Exp $   */
 
 /*-
  * Copyright (c) 1997-2011 The NetBSD Foundation, Inc.
@@ -67,7 +67,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vfs_mount.c,v 1.18 2013/04/26 22:27:16 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_mount.c,v 1.19 2013/04/28 21:34:31 mlelstv Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -866,18 +866,29 @@
        }
        mutex_exit(&mp->mnt_updating);
        vfs_scrubvnlist(mp);
+
+       /*
+        * release mnt_umounting lock here, because other code calls
+        * vfs_busy() while holding the mountlist_lock.
+        *
+        * mark filesystem as gone to prevent further umounts
+        * after mnt_umounting lock is gone, this also prevents
+        * vfs_busy() from succeeding.
+        */
+       mp->mnt_iflag |= IMNT_GONE;
+       mutex_exit(&mp->mnt_unmounting);
+
        mutex_enter(&mountlist_lock);
        if ((coveredvp = mp->mnt_vnodecovered) != NULLVP)
                coveredvp->v_mountedhere = NULL;
        CIRCLEQ_REMOVE(&mountlist, mp, mnt_list);
-       mp->mnt_iflag |= IMNT_GONE;
        mutex_exit(&mountlist_lock);
        if (TAILQ_FIRST(&mp->mnt_vnodelist) != NULL)
                panic("unmount: dangling vnode");
        if (used_syncer)
                mutex_exit(&syncer_mutex);
        vfs_hooks_unmount(mp);
-       mutex_exit(&mp->mnt_unmounting);
+
        vfs_destroy(mp);        /* reference from mount() */
        if (coveredvp != NULLVP) {
                vrele(coveredvp);