- Reorder calls to vrele() after calls to vput() when the vrele is a

   directory.  vrele() may lock the passed vnode, which in these cases would
   give an invalid lock order of child -> parent.  These situations are
   deadlock prone although do not typically deadlock because the vrele
   is typically not releasing the last reference to the vnode.  Users of
   vrele must consider it as a call to vn_lock() and order it appropriately.

MFC After: 	1 week
Sponsored by:	Isilon Systems, Inc.
Tested by:	kkenn

2 files changed, 11 insertions, 14 deletions

diff --git a/sys/fs/coda/coda_vnops.c b/sys/fs/coda/coda_vnops.c
index 94d95d98ec9f..75de19f361da 100644
--- a/sys/fs/coda/coda_vnops.c
+++ b/sys/fs/coda/coda_vnops.c
@@ -1289,21 +1289,18 @@ coda_rename(struct vop_rename_args *ap)
     /* XXX - do we need to call cache pureg on the moved vnode? */
     cache_purge(ap->a_fvp);
 
-    /* It seems to be incumbent on us to drop locks on all four vnodes */
-    /* From-vnodes are not locked, only ref'd.  To-vnodes are locked. */
-
-    vrele(ap->a_fvp);
+    /* Release parents first, then children. */
     vrele(odvp);
-
     if (ap->a_tvp) {
-	if (ap->a_tvp == ndvp) {
-	    vrele(ap->a_tvp);
-	} else {
-	    vput(ap->a_tvp);
-	}
-    }
+	if (ap->a_tvp == ndvp)
+	    vrele(ndvp);
+	else
+	    vput(ndvp);
+	vput(ap->a_tvp);
+    } else
+	vput(ndvp);
+    vrele(ap->a_fvp);
 
-    vput(ndvp);
     return(error);
 }
 
diff --git a/sys/fs/msdosfs/msdosfs_vnops.c b/sys/fs/msdosfs/msdosfs_vnops.c
index 15665e0778fb..abf4e8a5b9ef 100644
--- a/sys/fs/msdosfs/msdosfs_vnops.c
+++ b/sys/fs/msdosfs/msdosfs_vnops.c
@@ -1122,10 +1122,10 @@ abortit:
 		 */
 		if (doingdirectory)
 			panic("rename: lost dir entry");
-		vrele(ap->a_fvp);
 		if (newparent)
 			VOP_UNLOCK(tdvp, 0, td);
 		vrele(tdvp);
+		vrele(ap->a_fvp);
 		return 0;
 	}
 	xp = VTODE(fvp);
@@ -1143,10 +1143,10 @@ abortit:
 	if (xp != ip) {
 		if (doingdirectory)
 			panic("rename: lost dir entry");
-		vrele(ap->a_fvp);
 		VOP_UNLOCK(fvp, 0, td);
 		if (newparent)
 			VOP_UNLOCK(fdvp, 0, td);
+		vrele(ap->a_fvp);
 		xp = NULL;
 	} else {
 		vrele(fvp);