The kernel may has double mutex locks, and the code path in file "sys/kern/vfs_subr.c" in FreeBSD 11.0 release is: vflush [line 3050: acquire the lock by VI_LOCK] vgone [line 3057] VI_LOCK [line 3100] --> lock again This bug is found by a static analysis tool written by myself, and it is checked by my review of the FreeBSD code. Jia-Ju Bai
The code is: VOP_LOCK(rootvp, LK_EXCLUSIVE|LK_INTERLOCK); vgone(rootvp); The LK_INTERLOCK flags tells the locking routine that the interlock is held and the contract is that it is dropped prior to return, hence vgone is called without the lock held.