kern/60986: fssconfig panics on bad backing store type

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60986
>Category:       kern
>Synopsis:       fssconfig panics on bad backing store type
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 10 18:45:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The S_IFMT Fssup
>Environment:
>Description:

	fss(4) releases a vnode obtained with vn_open with vrele
	instead of vn_close on error (if the vnode is neither VREG nor
	VCHR, e.g. if it is VBLK instead).

    791 	error = vn_open(NULL, pb2, 0, FREAD|FWRITE, 0, &vp2, NULL, NULL);
...
    800 	if (vp2->v_type != VREG && vp2->v_type != VCHR) {
    801 		vrele(vp2);
    802 		pathbuf_destroy(pb2);
    803 		return EINVAL;
    804 	}

	https://nxr.netbsd.org/xref/src/sys/dev/fss.c?r=1.116#791

	This mistake leads to:

# fssconfig fss0 / /dev/ld4
[  20.8227167] vnode 0xffff00007d3c3c00 flags 0x10<MPSAFE>
[  20.8322628]  tag VT_UFS(1) type VBLK(3) mount 0xffff00007dafc000 typedata 0xffff00007dd97f40
[  20.8322628]  usecount 1 writecount 1 holdcount 0
[  20.8423793]  size 100000000 writesize 100000000 numoutput 0
[  20.8423793]  data 0xffff00007d1f8940 lock 0xffff00007d3c3e80
[  20.8423793]  state LOADED key(0xffff00007dafc000 8) 94 06 00 00 00 00 00 00
[  20.8525647]  lrulisthd 0xffffc00001266790
[  20.8525647]  tag VT_UFS, ino 1684, on dev 168, 1 flags 0x0, nlink 1
[  20.8525647]  mode 060640, owner 0, group 5, size 0
[  20.8625651] panic: vrelel: bad ref count
[  20.8625651] cpu1: Begin traceback...
[  20.8625651] trace fp ffffc000c6507900
[  20.8726955] fp ffffc000c6507930 vpanic() at ffffc00000637940 netbsd:vpanic+0x1c0
[  20.8941230] fp ffffc000c6507990 vnpanic() at ffffc000006ace18 netbsd:vnpanic+0x78
[  20.9041283] fp ffffc000c6507a30 vrelel() at ffffc000006aef3c netbsd:vrelel+0xa9c
[  20.9248854] fp ffffc000c6507ab0 fss_ioctl() at ffffc000006d858c netbsd:fss_ioctl+0xa48
[  20.9571800] fp ffffc000c6507b70 cdev_ioctl() at ffffc0000061ed80 netbsd:cdev_ioctl+0x90
[  20.9663878] fp ffffc000c6507bc0 spec_ioctl() at ffffc000006cc844 netbsd:spec_ioctl+0x58
[  20.9765427] fp ffffc000c6507c00 VOP_IOCTL() at ffffc000006bd388 netbsd:VOP_IOCTL+0x40
[  20.9981228] fp ffffc000c6507c50 vn_ioctl() at ffffc000006b371c netbsd:vn_ioctl+0xd0
[  21.0091130] fp ffffc000c6507d50 sys_ioctl() at ffffc0000064eb3c netbsd:sys_ioctl+0x1bc
[  21.0301681] fp ffffc000c6507e30 syscall() at ffffc000000c01bc netbsd:syscall+0x11c

>How-To-Repeat:

	fssconfig fss0 / /dev/ld4

	instead of

	fssconfig fss0 / /dev/rld4

>Fix:

	s/vrele/vn_close/, and some more testing