Correctly handle b_vp with bgetvp and brelvp in {get,put}pages.

Prevents panics caused by vnodes being recycled under our feet.

4 files changed, 34 insertions, 17 deletions

diff --git a/sys/kern/vfs_default.c b/sys/kern/vfs_default.c
index 61f6d0217e9..89b1edee6a6 100644
--- a/sys/kern/vfs_default.c
+++ b/sys/kern/vfs_default.c
@@ -1,4 +1,4 @@
-/*       $OpenBSD: vfs_default.c,v 1.8 2001/11/27 05:27:12 art Exp $  */
+/*       $OpenBSD: vfs_default.c,v 1.9 2001/11/29 01:58:57 art Exp $  */
 
 /*
  *    Portions of this code are:
@@ -529,7 +529,8 @@ genfs_getpages(v)
 	mbp->b_resid = mbp->b_bcount = bytes;
 	mbp->b_flags = B_BUSY|B_READ| (async ? B_CALL : 0);
 	mbp->b_iodone = uvm_aio_biodone;
-	mbp->b_vp = vp;
+	mbp->b_vp = NULL;
+	bgetvp(vp, mbp);
 	LIST_INIT(&mbp->b_dep);
 
 	/*
@@ -637,7 +638,7 @@ genfs_getpages(v)
 		 * allocate a sub-buf for this piece of the i/o
 		 * (or just use mbp if there's only 1 piece),
 		 * and start it going.
-		 */
+ 		 */
 
 		if (offset == startoffset && iobytes == bytes) {
 			bp = mbp;
@@ -688,6 +689,9 @@ loopdone:
 		error = biowait(mbp);
 	}
 	s = splbio();
+	if (mbp->b_vp != NULL) {
+		brelvp(mbp);
+	}
 	pool_put(&bufpool, mbp);
 	splx(s);
 	uvm_pagermapout(kva, npages);
@@ -887,7 +891,8 @@ genfs_putpages(v)
 		(async ? B_CALL : 0) |
 		(curproc == uvm.pagedaemon_proc ? B_PDAEMON : 0);
 	mbp->b_iodone = uvm_aio_biodone;
-	mbp->b_vp = vp;
+	mbp->b_vp = NULL;
+	bgetvp(vp, mbp);
 	LIST_INIT(&mbp->b_dep);
 
 	bp = NULL;
@@ -963,8 +968,10 @@ genfs_putpages(v)
 		(*bioops.io_pageiodone)(mbp);
 	}
 	s = splbio();
-	if (mbp->b_vp)
+	if (mbp->b_vp) {
 		vwakeup(mbp->b_vp);
+		brelvp(mbp);
+	}
 	pool_put(&bufpool, mbp);
 	splx(s);
 	uvm_pagermapout(kva, npages);
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c
index 7f668a7edde..f3582edd29f 100644
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfs_subr.c,v 1.73 2001/11/27 05:27:12 art Exp $	*/
+/*	$OpenBSD: vfs_subr.c,v 1.74 2001/11/29 01:58:57 art Exp $	*/
 /*	$NetBSD: vfs_subr.c,v 1.53 1996/04/22 01:39:13 christos Exp $	*/
 
 /*
@@ -2000,17 +2000,17 @@ vinvalbuf(vp, flags, cred, p, slpflag, slptimeo)
 	struct uvm_object *uobj = &vp->v_uvm.u_obj;
 	struct buf *bp;
 	struct buf *nbp, *blist;
-	int s, error, rv;
+	int s, error;
 	int flushflags = PGO_ALLPAGES|PGO_FREE|PGO_SYNCIO|
 	    (flags & V_SAVE ? PGO_CLEANIT : 0);
 
 	/* XXXUBC this doesn't look at flags or slp* */
 	if (vp->v_type == VREG) {
 		simple_lock(&uobj->vmobjlock);
-		rv = (uobj->pgops->pgo_flush)(uobj, 0, 0, flushflags);
+		error = (uobj->pgops->pgo_flush)(uobj, 0, 0, flushflags);
 		simple_unlock(&uobj->vmobjlock);
-		if (!rv) {
-			return EIO;
+		if (error) {
+			return error;
 		}
 	}
 
diff --git a/sys/nfs/nfs_bio.c b/sys/nfs/nfs_bio.c
index 42b25763a88..74c994def2a 100644
--- a/sys/nfs/nfs_bio.c
+++ b/sys/nfs/nfs_bio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_bio.c,v 1.25 2001/11/27 05:27:12 art Exp $	*/
+/*	$OpenBSD: nfs_bio.c,v 1.26 2001/11/29 01:59:19 art Exp $	*/
 /*	$NetBSD: nfs_bio.c,v 1.25.4.2 1996/07/08 20:47:04 jtc Exp $	*/
 
 /*
@@ -757,7 +757,8 @@ nfs_getpages(v)
 	mbp->b_resid = mbp->b_bcount = bytes;
 	mbp->b_flags = B_BUSY|B_READ| (async ? B_CALL|B_ASYNC : 0);
 	mbp->b_iodone = uvm_aio_biodone;
-	mbp->b_vp = vp;
+	mbp->b_vp = NULL;
+	bgetvp(vp, mbp);
 	mbp->b_proc = NULL;		/* XXXUBC */
 	LIST_INIT(&mbp->b_dep);
 
@@ -864,6 +865,9 @@ loopdone:
 		error = biowait(mbp);
 	}
 	s = splbio();
+	if (mbp->b_vp != NULL) {
+		brelvp(mbp);
+	}
 	pool_put(&bufpool, mbp);
 	splx(s);
 	uvm_pagermapout(kva, npages);
@@ -1047,7 +1051,8 @@ nfs_putpages(v)
 		(async ? B_CALL|B_ASYNC : 0) |
 		(curproc == uvm.pagedaemon_proc ? B_PDAEMON : 0);
 	mbp->b_iodone = uvm_aio_biodone;
-	mbp->b_vp = vp;
+	mbp->b_vp = NULL;
+	bgetvp(vp, mbp);
 	mbp->b_proc = NULL;		/* XXXUBC */
 	LIST_INIT(&mbp->b_dep);
 
@@ -1109,8 +1114,10 @@ nfs_putpages(v)
 	}
 
 	s = splbio();
-	if (mbp->b_vp)
+	if (mbp->b_vp) {
 		vwakeup(mbp->b_vp);
+		brelvp(mbp);
+	}
 	pool_put(&bufpool, mbp);
 	splx(s);
 
diff --git a/sys/uvm/uvm_pager.c b/sys/uvm/uvm_pager.c
index 662fb9fa346..fa627e06518 100644
--- a/sys/uvm/uvm_pager.c
+++ b/sys/uvm/uvm_pager.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_pager.c,v 1.25 2001/11/28 19:28:15 art Exp $	*/
+/*	$OpenBSD: uvm_pager.c,v 1.26 2001/11/29 01:59:19 art Exp $	*/
 /*	$NetBSD: uvm_pager.c,v 1.48 2001/06/23 20:47:44 chs Exp $	*/
 
 /*
@@ -873,8 +873,11 @@ uvm_aio_aiodone(bp)
 freed:
 #endif
 	s = splbio();
-	if (write && (bp->b_flags & B_AGE) != 0 && bp->b_vp != NULL) {
-		vwakeup(bp->b_vp);
+	if (bp->b_vp != NULL) {
+		if (write && (bp->b_flags & B_AGE) != 0) {
+			vwakeup(bp->b_vp);
+		}
+		brelvp(bp);
 	}
 	pool_put(&bufpool, bp);
 	splx(s);