POSTCR-965170da4548176cb0ec4ee65e01248af37f8824-2: pre-existing:                              
swapgeom_close() never releases the sw_vp reference that kern_swapon() keeps for              
GEOM swap devices                                                                             
                                                                                              
On success, kern_swapon() calls VOP_UNLOCK(vp) and keeps the namei() reference                
as sw_vp. swapdev_close() (the NFS-file path) releases that reference with                    
vput(), but swapgeom_close() only tears down the g_consumer. As a result, each                
swapon/swapoff cycle on a disk leaks one usecount on the devfs vnode, or two                  
when POSTCR-965170da4548176cb0ec4ee65e01248af37f8824-1 is counted too. If the                 
device is destroyed (for example, mdconfig -d after swapoff), a doomed vnode is               
left behind that can never be freed.                                                          
                                                                                              
This dates from commit dee34ca4fcf0 (2003), which added the per-backend close                 
method.

POSTCR-9506d8e0b1788068cbd4c2cbc984cb6ee0dcb0ab-1: pre-existing: swapoff of a                 
GEOM-backed swap device never releases the devfs vnode reference taken by swapon              
                                                                                              
The reviewed commit did not introduce this bug. It is in nearby code.                         
                                                                                              
How it happens:                                                                               
- On success, kern_swapon() calls VOP_UNLOCK(vp) and keeps the namei reference,               
stored as sp->sw_vp (sys/vm/swap_pager.c:2697-2699, 2744).                                    
- For file-backed swap, swapdev_close() drops that reference with vput().                     
- For GEOM-backed swap, swapgeom_close() (sys/vm/swap_pager.c:3270) only tears                
down the consumer. Neither swapgeom_close() nor swapoff_one() ever releases                   
sp->sw_vp.                                                                                    
                                                                                              
Origin: The bug was introduced in dee34ca4fcf0 ("Add a close() method to a                    
swapdev.", 2003). That commit moved the release into swapdev_close() but gave                 
swapgeom_close() no equivalent.                                                               
                                                                                              
Consequences: Each swapon/swapoff cycle on a disk device leaks one use reference              
on the devfs vnode. As a result:                                                              
- The vnode can never be recycled.                                                            
- After the device is destroyed (e.g. mdconfig -d, gpart delete), devfs dooms                 
the vnode, but its memory is never freed.                                                     
- While the device still exists, a non-forced unmount of the devfs instance                   
holding it fails with EBUSY.                                                                  
                                                                                              
Suggested fix: sw_close is only called from swapoff_one(), in thread context                  
with swdev_syscall_lock held, so the fix is simple. Either:                                   
- add vrele(sw->sw_vp) to swapgeom_close(), or                                                
- drop the reference in swapoff_one() for both backends and turn                              
swapdev_close()'s vput() into VOP_UNLOCK().                                                   
                                                                                              
The comment in swapgeom_close() about being called from biodone context looks                 
stale. The biodone path calls swapgeom_close_ev() directly, not                               
swapgeom_close().