msdosfs_rename(): more resilence against corruption

[kib]

Summary

msdosfs_rename(): handle errors from msdosfs_lookup_ino()

Properly working storage and correct filesystem structure indeed only
allow the EJUSTRETURN return code, but since the called function needs
to read directory blocks and (re)parse the content, the assert is not
neccessary hold.

PR:     276408

msdosfs_rename(): implement several XXXs about downgrading to ro

msdosfs_integrity_error(): plug possible busy leak

If taskqueue_enqueue() returned error, unbusy().
Handle parallel calls to msdosfs_integrity_error() by unbusying in
msdosfs_remount_ro() up to pending times.

[markj]

Suppose two threads call msdosfs_integrity_error() at around the same time. This function busies the mountpoint, then schedules a task to downgrade the mountpoint to RO. It's possible that both calls will be handled by a single call to msdosfs_remount_ro(pending = 2). There, the busy reference is released only once, so isn't it possible to leak?

[kib]

Handle pending taskq

[markj]

sys/fs/msdosfs/msdosfs_vfsops.c

1023 ↗

(On Diff #132928)

I do not see how an error can arise in practice.

[kib]

sys/fs/msdosfs/msdosfs_vfsops.c

1023 ↗

(On Diff #132928)

In principle this is true right now, but for completeness it is better be handled.

[kib]

Fix loop around vfs_unbusy():

-       } while (pending-- >= 0);
+       } while (--pending >= 0);