From 2e42808b96ccc7633f50d8f05fc52e172e2db944 Mon Sep 17 00:00:00 2001
From: David du Colombier <0intro@gmail.com>
Date: Fri, 5 Dec 1997 00:00:00 +0000
Subject: [PATCH] Plan 9 from Bell Labs 1997-12-05

---
 port/devmnt.c  |  4 ++--
 port/sysfile.c | 18 ++++++++++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/port/devmnt.c b/port/devmnt.c
index 9863801bc54f053cdce83849cef519714154e7c4..94d9811e25ab0dff53493ef65f6ad1412d3bf99f 100644
--- a/port/devmnt.c
+++ b/port/devmnt.c
@@ -92,9 +92,9 @@ mntattach(char *muxattach)
 		if(m->c == c && m->id) {
 			lock(m);
 			if(m->id && m->ref > 0 && m->c == c) {
-				unlock(&mntalloc);
 				m->ref++;
 				unlock(m);
+				unlock(&mntalloc);
 				c = mntchan();
 				if(waserror()) {
 					chanfree(c);
@@ -125,9 +125,9 @@ mntattach(char *muxattach)
 	m->list = mntalloc.list;
 	mntalloc.list = m;
 	m->id = mntalloc.id++;
-	lock(m);
 	unlock(&mntalloc);
 
+	lock(m);
 	m->ref = 1;
 	m->queue = 0;
 	m->rip = 0;
diff --git a/port/sysfile.c b/port/sysfile.c
index 1fc121d09b62d3300710d9b84cb9c26ef418da89..afdd8f1ea4aeddc39c0873a5b6aa5f35798501cc 100644
--- a/port/sysfile.c
+++ b/port/sysfile.c
@@ -109,19 +109,33 @@ openmode(ulong o)
 long
 sysfd2path(ulong *arg)
 {
-	Chan *c;
+	Chan *c, *oc;
 
 	validaddr(arg[1], 1, 0);
 	if(vmemchr((char*)arg[1], '\0', arg[2]) == 0)
 		error(Ebadarg);
 
-	c = fdtochan(arg[0], -1, 0, 0);
+	/*
+	 * Undomount below may cclose the chan so bump the
+	 * reference count to guard against it going to zero
+	 * and being freed.
+	 */
+	c = fdtochan(arg[0], -1, 0, 1);
+	if(waserror()) {
+		cclose(c);
+		nexterror();
+	}
 	/* If we used open the chan will be at the first element
 	 * of a union rather than the mhead of the union. undomount
 	 * will make it look like we used Atodir rather than Aopen.
 	 */
+	oc = c;
 	if(c->qid.path & CHDIR)
 		c = undomount(c);
+	poperror();
+	if(c == oc)
+		cclose(c);
+
 	ptpath(c->path, (char*)arg[1], arg[2]);
 	return 0;
 }