For the new regular tmpfs vnode, v_object is initialized before

insmntque() is called.  The standard insmntque destructor resets the
vop vector to deadfs one, and calls vgone() on the vnode.  As result,
v_object is kept unchanged, which triggers an assertion in the reclaim
code, on instmntque() failure.  Also, in this case, OBJ_TMPFS flag on
the backed vm object is not cleared.

Provide the tmpfs insmntque() destructor which properly clears
OBJ_TMPFS flag and resets v_object.

Reported and tested by:	pho
Sponsored by:	The FreeBSD Foundation

1 files changed, 2 insertions, 13 deletions

diff --git a/sys/fs/tmpfs/tmpfs_vnops.c b/sys/fs/tmpfs/tmpfs_vnops.c
index 029aefbdb5b3..480818125245 100644
--- a/sys/fs/tmpfs/tmpfs_vnops.c
+++ b/sys/fs/tmpfs/tmpfs_vnops.c
@@ -1468,23 +1468,12 @@ tmpfs_reclaim(struct vop_reclaim_args *v)
 
 	struct tmpfs_mount *tmp;
 	struct tmpfs_node *node;
-	vm_object_t obj;
 
 	node = VP_TO_TMPFS_NODE(vp);
 	tmp = VFS_TO_TMPFS(vp->v_mount);
 
-	if (node->tn_type == VREG) {
-		obj = node->tn_reg.tn_aobj;
-		if (obj != NULL) {
-			/* Instead of vnode_destroy_vobject() */
-			VM_OBJECT_WLOCK(obj);
-			VI_LOCK(vp);
-			vm_object_clear_flag(obj, OBJ_TMPFS);
-			obj->un_pager.swp.swp_tmpfs = NULL;
-			VI_UNLOCK(vp);
-			VM_OBJECT_WUNLOCK(obj);
-		}
-	}
+	if (vp->v_type == VREG)
+		tmpfs_destroy_vobject(vp, node->tn_reg.tn_aobj);
 	vp->v_object = NULL;
 	cache_purge(vp);