>Number:         5561
>Category:       kern
>Synopsis:       ffs_mountroot leaves a reference count on root device in some cases
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jun  9 17:35:00 1998
>Last-Modified:
>Originator:     Paul "S." Wain
>Organization:
Network Computer Inc.

>Release:        1.3.1
>Environment:
	IALC x86, NetBSD 1.3.1
	IALC x86, NetBSD 1.2.1
System: NetBSD  1.3.1 NetBSD 1.3.1 (DEV22.PXE) #4: Tue Jun  9 17:00:17 PDT 1998     pwain@pwain-nut.client.nc.com:/usr/pwain/source/kernel131/sys/arch/i386/compile/DEV22.PXE i386


>Description:
	If the boot device happens to be a disk with no DOS boot block and
	also contains no UNIX partitions (e.g. no /dev/wd0a) then a
	subsequent attempt to mount the 'a' partition on anything other than
	'/' will fail due to an incorrect usage count on the device.
>How-To-Repeat:
	Using a box that supports e.g. Intel Wired For Management, and a
	kernel that boots using the auto probe features, attempt to mount a
	disk that has no DOS partition and no unix partitions other than the
	raw disk (/dev/wd0d)
>Fix:
	The fix is a three line change to sys/ufs/ffs/ffs_vfsops.c in the
	ffs_mountroot() function (excluding comment):

		if ((error = ffs_mountfs(rootvp, mp, p)) != 0) {
	+		/*
	+		 * If root mount failed then decrement the counter if
	+		 * its non-zero. This is safe-ish here since we can
	+		 * be fairly sure we were the only people using the device
	+		 * at this point.
	+		 */
	+		if (vcount(rootvp) > 1) { 
	+			vrele(rootvp);
	+		}
			free(mp, M_MOUNT);
			return (error);
		}

	(Note: this must be done in ffs_mountroot and not ffs_mountfs to
	ensure other reference counts dont get screwed up by 
>Audit-Trail:
>Unformatted: