2 files changed, 14 insertions, 10 deletions

diff --git a/sys/compat/opensolaris/kern/opensolaris_vfs.c b/sys/compat/opensolaris/kern/opensolaris_vfs.c
index e3325ae00ad0..79a4c5bd162e 100644
--- a/sys/compat/opensolaris/kern/opensolaris_vfs.c
+++ b/sys/compat/opensolaris/kern/opensolaris_vfs.c
@@ -110,7 +110,7 @@ vfs_optionisset(const vfs_t *vfsp, const char *opt, char **argp)
 }
 
 int
-traverse(vnode_t **cvpp)
+traverse(vnode_t **cvpp, int lktype)
 {
 	kthread_t *td = curthread;
 	vnode_t *cvp;
@@ -119,7 +119,7 @@ traverse(vnode_t **cvpp)
 	int error;
 
 	cvp = *cvpp;
-	error = 0;
+	tvp = NULL;
 
 	/*
 	 * If this vnode is mounted on, then we transparently indirect
@@ -135,22 +135,26 @@ traverse(vnode_t **cvpp)
 		vfsp = vn_mountedvfs(cvp);
 		if (vfsp == NULL)
 			break;
-		VN_RELE(cvp);
+		/*
+		 * tvp is NULL for *cvpp vnode, which we can't unlock.
+		 */
+		if (tvp != NULL)
+			vput(cvp);
+		else
+			vrele(cvp);
 
 		/*
 		 * The read lock must be held across the call to VFS_ROOT() to
 		 * prevent a concurrent unmount from destroying the vfs.
 		 */
-		error = VFS_ROOT(vfsp, 0, &tvp, td);
-		if (error)
-			break;
-		VOP_UNLOCK(tvp, 0, td);
-
+		error = VFS_ROOT(vfsp, lktype, &tvp, td);
+		if (error != 0)
+			return (error);
 		cvp = tvp;
 	}
 
 	*cvpp = cvp;
-	return (error);
+	return (0);
 }
 
 int
diff --git a/sys/compat/opensolaris/sys/vfs.h b/sys/compat/opensolaris/sys/vfs.h
index 4a018ffbaef4..c2d8a6b71119 100644
--- a/sys/compat/opensolaris/sys/vfs.h
+++ b/sys/compat/opensolaris/sys/vfs.h
@@ -107,7 +107,7 @@ void vfs_setmntopt(vfs_t *vfsp, const char *name, const char *arg,
     int flags __unused);
 void vfs_clearmntopt(vfs_t *vfsp, const char *name);
 int vfs_optionisset(const vfs_t *vfsp, const char *opt, char **argp);
-int traverse(vnode_t **cvpp);
+int traverse(vnode_t **cvpp, int lktype);
 int domount(kthread_t *td, vnode_t *vp, const char *fstype, char *fspath,
     char *fspec, int fsflags);