nullfs: Fix handling of doomed vnodes in nullfs_unlink_lowervp()

[markj]

Summary

nullfs_unlink_lowervp() is called with the lower vnode locked, so the
nullfs vnode is locked too. The following can occur:

1. the vunref() call decrements the usecount 2->1,
2. a different thread calls vrele() on the vnode, decrements the usecount 0->1,
3. the first thread tests vp->v_usecount == 0 and observes that it is true,
4. the first thread incorrectly unlocks the lower vnode.

Fix this by testing VN_IS_DOOMED directly. Since
nullfs_unlink_lowervp() holds the vnode lock, the value of the
VIRF_DOOMED flag is stable.

PR: 288345

[kib]

sys/fs/nullfs/null_vfsops.c

465–466

This comment as is no longer holds.

478–479

This assert is tautological now.

[markj]

Handle feedback

[kib]

sys/fs/nullfs/null_vfsops.c

468

I think it is enough to say 'If the vnode is doomed, its lock was split from the lower vnode lock.'

[markj]

Make the comment more terse