Cleanup VFS mount string handling:

- Avoid using copyinstr() without checking the return value.

- sys_mount() has already copied the path in, so pass this to the
  filesystem mount code so that it does not have to copy it in again.

- Avoid copyinstr()/bzero() dance when we can simply bzero() and strlcpy().

ok krw@

11 files changed, 108 insertions, 123 deletions

diff --git a/sys/isofs/cd9660/cd9660_vfsops.c b/sys/isofs/cd9660/cd9660_vfsops.c
index 5d4434860f7..d5a7dc5b3b9 100644
--- a/sys/isofs/cd9660/cd9660_vfsops.c
+++ b/sys/isofs/cd9660/cd9660_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cd9660_vfsops.c,v 1.60 2011/07/04 20:35:35 deraadt Exp $	*/
+/*	$OpenBSD: cd9660_vfsops.c,v 1.61 2012/09/10 11:10:59 jsing Exp $	*/
 /*	$NetBSD: cd9660_vfsops.c,v 1.26 1997/06/13 15:38:58 pk Exp $	*/
 
 /*-
@@ -134,34 +134,38 @@ cd9660_mount(mp, path, data, ndp, p)
 	struct nameidata *ndp;
 	struct proc *p;
 {
-	struct vnode *devvp;
+	struct iso_mnt *imp = NULL;
 	struct iso_args args;
-	size_t size;
+	struct vnode *devvp;
+	char fspec[MNAMELEN];
 	int error;
-	struct iso_mnt *imp = NULL;
-	
-	error = copyin(data, &args, sizeof (struct iso_args));
-	if (error)
-		return (error);
 	
 	if ((mp->mnt_flag & MNT_RDONLY) == 0)
 		return (EROFS);
 	
+	error = copyin(data, &args, sizeof(struct iso_args));
+	if (error)
+		return (error);
+
 	/*
 	 * If updating, check whether changing from read-only to
 	 * read/write; if there is no device name, that's all we do.
 	 */
 	if (mp->mnt_flag & MNT_UPDATE) {
 		imp = VFSTOISOFS(mp);
-		if (args.fspec == 0)
+		if (args.fspec == NULL)
 			return (vfs_export(mp, &imp->im_export, 
 			    &args.export_info));
 	}
+
 	/*
 	 * Not an update, or updating the name: look up the name
 	 * and verify that it refers to a sensible block device.
 	 */
-	NDINIT(ndp, LOOKUP, FOLLOW, UIO_USERSPACE, args.fspec, p);
+	error = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
+	if (error)
+		return (error);
+	NDINIT(ndp, LOOKUP, FOLLOW, UIO_SYSSPACE, fspec, p);
 	if ((error = namei(ndp)) != 0)
 		return (error);
 	devvp = ndp->ni_vp;
@@ -174,6 +178,7 @@ cd9660_mount(mp, path, data, ndp, p)
 		vrele(devvp);
 		return (ENXIO);
 	}
+
 	/*
 	 * If mount by non-root, then verify that user has necessary
 	 * permissions on the device.
@@ -200,13 +205,15 @@ cd9660_mount(mp, path, data, ndp, p)
 		return (error);
 	}
 	imp = VFSTOISOFS(mp);
-	(void)copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &size);
-	bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
-	(void)copyinstr(args.fspec, mp->mnt_stat.f_mntfromname, MNAMELEN - 1,
-	    &size);
-	bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
+
+	bzero(mp->mnt_stat.f_mntonname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntonname, path, MNAMELEN);
+	bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
 	bcopy(&args, &mp->mnt_stat.mount_info.iso_args, sizeof(args));
-	(void)cd9660_statfs(mp, &mp->mnt_stat, p);
+
+	cd9660_statfs(mp, &mp->mnt_stat, p);
+
 	return (0);
 }
 
diff --git a/sys/isofs/udf/udf_vfsops.c b/sys/isofs/udf/udf_vfsops.c
index 5e13fb6a772..cb3fbe46e69 100644
--- a/sys/isofs/udf/udf_vfsops.c
+++ b/sys/isofs/udf/udf_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udf_vfsops.c,v 1.38 2011/07/04 20:35:35 deraadt Exp $	*/
+/*	$OpenBSD: udf_vfsops.c,v 1.39 2012/09/10 11:10:59 jsing Exp $	*/
 
 /*
  * Copyright (c) 2001, 2002 Scott Long <scottl@freebsd.org>
@@ -122,7 +122,7 @@ udf_mount(struct mount *mp, const char *path, void *data,
 {
 	struct vnode *devvp;	/* vnode of the mount device */
 	struct udf_args args;
-	size_t len;
+	char fspec[MNAMELEN];
 	int error;
 
 	if ((mp->mnt_flag & MNT_RDONLY) == 0) {
@@ -146,7 +146,11 @@ udf_mount(struct mount *mp, const char *path, void *data,
 	if (args.fspec == NULL)
 		return (EINVAL);
 
-	NDINIT(ndp, LOOKUP, FOLLOW, UIO_USERSPACE, args.fspec, p);
+	error = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
+	if (error)
+		return (error);
+
+	NDINIT(ndp, LOOKUP, FOLLOW, UIO_SYSSPACE, fspec, p);
 	if ((error = namei(ndp)))
 		return (error);
 
@@ -180,10 +184,10 @@ udf_mount(struct mount *mp, const char *path, void *data,
 	/*
 	 * Keep a copy of the mount information.
 	 */
-	copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &len);
-	bzero(mp->mnt_stat.f_mntonname + len, MNAMELEN - len);
-	copyinstr(args.fspec, mp->mnt_stat.f_mntfromname, MNAMELEN - 1, &len);
-	bzero(mp->mnt_stat.f_mntfromname + len, MNAMELEN - len);
+	bzero(mp->mnt_stat.f_mntonname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntonname, path, MNAMELEN);
+	bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
 
 	return (0);
 };
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index a408f1dded4..6ec5e840041 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfs_syscalls.c,v 1.188 2012/09/10 02:21:56 deraadt Exp $	*/
+/*	$OpenBSD: vfs_syscalls.c,v 1.189 2012/09/10 11:10:59 jsing Exp $	*/
 /*	$NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $	*/
 
 /*
@@ -269,7 +269,7 @@ update:
 	/*
 	 * Mount the filesystem.
 	 */
-	error = VFS_MOUNT(mp, SCARG(uap, path), SCARG(uap, data), &nd, p);
+	error = VFS_MOUNT(mp, fspath, SCARG(uap, data), &nd, p);
 	if (!error) {
 		mp->mnt_stat.f_ctime = time_second;
 	}
diff --git a/sys/miscfs/procfs/procfs_vfsops.c b/sys/miscfs/procfs/procfs_vfsops.c
index 4663c10a0c3..74af59994e1 100644
--- a/sys/miscfs/procfs/procfs_vfsops.c
+++ b/sys/miscfs/procfs/procfs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_vfsops.c,v 1.27 2012/04/10 15:50:52 guenther Exp $	*/
+/*	$OpenBSD: procfs_vfsops.c,v 1.28 2012/09/10 11:10:59 jsing Exp $	*/
 /*	$NetBSD: procfs_vfsops.c,v 1.25 1996/02/09 22:40:53 christos Exp $	*/
 
 /*
@@ -71,7 +71,6 @@ int
 procfs_mount(struct mount *mp, const char *path, void *data, struct nameidata *ndp,
     struct proc *p)
 {
-	size_t size;
 	struct procfsmount *pmnt;
 	struct procfs_args args;
 	int error;
@@ -85,7 +84,7 @@ procfs_mount(struct mount *mp, const char *path, void *data, struct nameidata *n
 		return (EOPNOTSUPP);
 
 	if (data != NULL) {
-		error = copyin(data, &args, sizeof args);
+		error = copyin(data, &args, sizeof(args));
 		if (error != 0)
 			return (error);
 
@@ -101,8 +100,8 @@ procfs_mount(struct mount *mp, const char *path, void *data, struct nameidata *n
 	mp->mnt_data = pmnt;
 	vfs_getnewfsid(mp);
 
-	(void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &size);
-	bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
+	bzero(mp->mnt_stat.f_mntonname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntonname, path, MNAMELEN);
 	bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
 	bcopy("procfs", mp->mnt_stat.f_mntfromname, sizeof("procfs"));
 	bcopy(&args, &mp->mnt_stat.mount_info.procfs_args, sizeof(args));
diff --git a/sys/msdosfs/msdosfs_vfsops.c b/sys/msdosfs/msdosfs_vfsops.c
index 5c56567dc03..a463fec4e0e 100644
--- a/sys/msdosfs/msdosfs_vfsops.c
+++ b/sys/msdosfs/msdosfs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: msdosfs_vfsops.c,v 1.61 2011/07/04 20:35:35 deraadt Exp $	*/
+/*	$OpenBSD: msdosfs_vfsops.c,v 1.62 2012/09/10 11:10:59 jsing Exp $	*/
 /*	$NetBSD: msdosfs_vfsops.c,v 1.48 1997/10/18 02:54:57 briggs Exp $	*/
 
 /*-
@@ -101,10 +101,9 @@ msdosfs_mount(struct mount *mp, const char *path, void *data,
 	struct msdosfs_args args; /* will hold data from mount request */
 	/* msdosfs specific mount control block */
 	struct msdosfsmount *pmp = NULL;
-	size_t size;
+	char fspec[MNAMELEN];
 	int error, flags;
 	mode_t accessmode;
-	char *fspec = NULL;
 
 	error = copyin(data, &args, sizeof(struct msdosfs_args));
 	if (error)
@@ -146,7 +145,7 @@ msdosfs_mount(struct mount *mp, const char *path, void *data,
 			}
 			pmp->pm_flags &= ~MSDOSFSMNT_RONLY;
 		}
-		if (args.fspec == 0) {
+		if (args.fspec == NULL) {
 #ifdef	__notyet__		/* doesn't work correctly with current mountd	XXX */
 			if (args.flags & MSDOSFSMNT_MNTOPT) {
 				pmp->pm_flags &= ~MSDOSFSMNT_MNTOPT;
@@ -167,8 +166,7 @@ msdosfs_mount(struct mount *mp, const char *path, void *data,
 	 * Not an update, or updating the name: look up the name
 	 * and verify that it refers to a sensible block device.
 	 */
-	fspec = malloc(MNAMELEN, M_MOUNT, M_WAITOK);
-	error = copyinstr(args.fspec, fspec, MNAMELEN - 1, &size);
+	error = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
 	if (error)
 		goto error;
 	disk_map(fspec, fspec, MNAMELEN, DM_OPENBLCK);
@@ -242,25 +240,24 @@ msdosfs_mount(struct mount *mp, const char *path, void *data,
 			vput(rvp);
 		}
 	}
-	(void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &size);
-	bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
 
-	size = strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN - 1);
-	bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
+	bzero(mp->mnt_stat.f_mntonname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntonname, path, MNAMELEN);
+	bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
 	bcopy(&args, &mp->mnt_stat.mount_info.msdosfs_args, sizeof(args));
+
 #ifdef MSDOSFS_DEBUG
 	printf("msdosfs_mount(): mp %x, pmp %x, inusemap %x\n", mp,
 	    pmp, pmp->pm_inusemap);
 #endif
+
 	return (0);
 
 error_devvp:
 	vrele(devvp);
 
 error:
-	if (fspec)
-		free(fspec, M_MOUNT);
-
 	return (error);
 }
 
diff --git a/sys/nfs/nfs_vfsops.c b/sys/nfs/nfs_vfsops.c
index 4260cf4a1ab..bb91cb04877 100644
--- a/sys/nfs/nfs_vfsops.c
+++ b/sys/nfs/nfs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_vfsops.c,v 1.93 2011/07/09 00:24:44 beck Exp $	*/
+/*	$OpenBSD: nfs_vfsops.c,v 1.94 2012/09/10 11:10:59 jsing Exp $	*/
 /*	$NetBSD: nfs_vfsops.c,v 1.46.4.1 1996/05/25 22:40:35 fvdl Exp $	*/
 
 /*
@@ -560,8 +560,8 @@ nfs_decode_args(struct nfsmount *nmp, struct nfs_args *argp,
  * VFS Operations.
  *
  * mount system call
- * It seems a bit dumb to copyinstr() the host and path here and then
- * bcopy() them in mountnfs(), but I wanted to detect errors before
+ * It seems a bit dumb to copyinstr() the host here and then
+ * bcopy() it in mountnfs(), but I wanted to detect errors before
  * doing the sockargs() call because sockargs() allocates an mbuf and
  * an error after that means that I have to release the mbuf.
  */
@@ -573,23 +573,21 @@ nfs_mount(struct mount *mp, const char *path, void *data,
 	int error;
 	struct nfs_args args;
 	struct mbuf *nam;
-	char pth[MNAMELEN], hst[MNAMELEN];
+	char hst[MNAMELEN];
 	size_t len;
 	u_char nfh[NFSX_V3FHMAX];
 
-	error = copyin (data, &args, sizeof (args.version));
+	error = copyin(data, &args, sizeof(args.version));
 	if (error)
 		return (error);
 	if (args.version == 3) {
 		error = copyin (data, (caddr_t)&args,
 				sizeof (struct nfs_args3));
 		args.flags &= ~(NFSMNT_INTERNAL|NFSMNT_NOAC);
-	}
-	else if (args.version == NFS_ARGSVERSION) {
+	} else if (args.version == NFS_ARGSVERSION) {
 		error = copyin(data, (caddr_t)&args, sizeof (struct nfs_args));
 		args.flags &= ~NFSMNT_NOAC; /* XXX - compatibility */
-	}
-	else
+	} else
 		return (EPROGMISMATCH);
 	if (error)
 		return (error);
@@ -621,10 +619,6 @@ nfs_mount(struct mount *mp, const char *path, void *data,
 	error = copyin((caddr_t)args.fh, (caddr_t)nfh, args.fhsize);
 	if (error)
 		return (error);
-	error = copyinstr(path, pth, MNAMELEN-1, &len);
-	if (error)
-		return (error);
-	bzero(&pth[len], MNAMELEN - len);
 	error = copyinstr(args.hostname, hst, MNAMELEN-1, &len);
 	if (error)
 		return (error);
@@ -634,7 +628,7 @@ nfs_mount(struct mount *mp, const char *path, void *data,
 	if (error)
 		return (error);
 	args.fh = nfh;
-	error = mountnfs(&args, mp, nam, pth, hst);
+	error = mountnfs(&args, mp, nam, path, hst);
 	return (error);
 }
 
@@ -642,8 +636,8 @@ nfs_mount(struct mount *mp, const char *path, void *data,
  * Common code for mount and mountroot
  */
 int
-mountnfs(struct nfs_args *argp, struct mount *mp, struct mbuf *nam, char *pth,
-    char *hst)
+mountnfs(struct nfs_args *argp, struct mount *mp, struct mbuf *nam,
+    const char *pth, char *hst)
 {
 	struct nfsmount *nmp;
 	int error;
diff --git a/sys/nfs/nfsmount.h b/sys/nfs/nfsmount.h
index fc6fcf9bc05..aea7cd7ed40 100644
--- a/sys/nfs/nfsmount.h
+++ b/sys/nfs/nfsmount.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfsmount.h,v 1.24 2009/09/02 18:20:54 thib Exp $	*/
+/*	$OpenBSD: nfsmount.h,v 1.25 2012/09/10 11:10:59 jsing Exp $	*/
 /*	$NetBSD: nfsmount.h,v 1.10 1996/02/18 11:54:03 fvdl Exp $	*/
 
 /*
@@ -86,8 +86,8 @@ struct	nfsmount {
 /* Prototypes for NFS mount operations: */
 int	nfs_mount(struct mount *, const char *, void *, struct nameidata *,
 	    struct proc *);
-int	mountnfs(struct nfs_args *, struct mount *, struct mbuf *, char *,
-	    char *);
+int	mountnfs(struct nfs_args *, struct mount *, struct mbuf *,
+	    const char *, char *);
 int	nfs_mountroot(void);
 void	nfs_decode_args(struct nfsmount *, struct nfs_args *,
 	    struct nfs_args *);
diff --git a/sys/ntfs/ntfs_vfsops.c b/sys/ntfs/ntfs_vfsops.c
index 722f2a50db6..86de5919f16 100644
--- a/sys/ntfs/ntfs_vfsops.c
+++ b/sys/ntfs/ntfs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ntfs_vfsops.c,v 1.28 2011/12/20 09:13:07 mikeb Exp $	*/
+/*	$OpenBSD: ntfs_vfsops.c,v 1.29 2012/09/10 11:11:00 jsing Exp $	*/
 /*	$NetBSD: ntfs_vfsops.c,v 1.7 2003/04/24 07:50:19 christos Exp $	*/
 
 /*-
@@ -165,9 +165,8 @@ ntfs_mount(
 	int		err = 0;
 	struct vnode	*devvp;
 	struct ntfs_args args;
-	size_t size;
+	char fspec[MNAMELEN];
 	mode_t amode;
-	char *fspec = NULL;
 
 	/*
 	 ***
@@ -186,7 +185,7 @@ ntfs_mount(
 	 */
 	if (mp->mnt_flag & MNT_UPDATE) {
 		/* if not updating name...*/
-		if (args.fspec == 0) {
+		if (args.fspec == NULL) {
 			/*
 			 * Process export requests.  Jumping to "success"
 			 * will return the vfs_export() error code.
@@ -205,8 +204,7 @@ ntfs_mount(
 	 * Not an update, or updating the name: look up the name
 	 * and verify that it refers to a sensible block device.
 	 */
-	fspec = malloc(MNAMELEN, M_MOUNT, M_WAITOK);
-	err = copyinstr(args.fspec, fspec, MNAMELEN - 1, &size);
+	err = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
 	if (err)
 		goto error_1;
 	disk_map(fspec, fspec, MNAMELEN, DM_OPENBLCK);
@@ -277,12 +275,10 @@ ntfs_mount(
 		 * upper level code.
 		 */
 		/* Save "last mounted on" info for mount point (NULL pad)*/
-		(void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1,
-		           &size);
-		bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
-
-		size = strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN - 1);
-		bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
+		bzero(mp->mnt_stat.f_mntonname, MNAMELEN);
+		strlcpy(mp->mnt_stat.f_mntonname, path, MNAMELEN);
+		bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+		strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
 		bcopy(&args, &mp->mnt_stat.mount_info.ntfs_args, sizeof(args));
 		if ( !err) {
 			err = ntfs_mountfs(devvp, mp, &args, p);
@@ -311,9 +307,6 @@ error_2:	/* error with devvp held*/
 error_1:	/* no state to back out*/
 
 success:
-	if (fspec)
-		free(fspec, M_MOUNT);
-
 	return(err);
 }
 
diff --git a/sys/ufs/ext2fs/ext2fs_vfsops.c b/sys/ufs/ext2fs/ext2fs_vfsops.c
index a3f618ce44a..9902670485f 100644
--- a/sys/ufs/ext2fs/ext2fs_vfsops.c
+++ b/sys/ufs/ext2fs/ext2fs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ext2fs_vfsops.c,v 1.64 2011/07/04 20:35:35 deraadt Exp $	*/
+/*	$OpenBSD: ext2fs_vfsops.c,v 1.65 2012/09/10 11:11:00 jsing Exp $	*/
 /*	$NetBSD: ext2fs_vfsops.c,v 1.1 1997/06/11 09:34:07 bouyer Exp $	*/
 
 /*
@@ -167,10 +167,9 @@ ext2fs_mount(struct mount *mp, const char *path, void *data,
 	struct ufs_args args;
 	struct ufsmount *ump = NULL;
 	struct m_ext2fs *fs;
-	size_t size;
+	char fspec[MNAMELEN];
 	int error, flags;
 	mode_t accessmode;
-	char *fspec = NULL;
 
 	error = copyin(data, (caddr_t)&args, sizeof (struct ufs_args));
 	if (error)
@@ -224,7 +223,7 @@ ext2fs_mount(struct mount *mp, const char *path, void *data,
 				fs->e2fs.e2fs_state = E2FS_ERRORS;
 			fs->e2fs_fmod = 1;
 		}
-		if (args.fspec == 0) {
+		if (args.fspec == NULL) {
 			/*
 			 * Process export requests.
 			 */
@@ -236,8 +235,7 @@ ext2fs_mount(struct mount *mp, const char *path, void *data,
 	 * Not an update, or updating the name: look up the name
 	 * and verify that it refers to a sensible block device.
 	 */
-	fspec = malloc(MNAMELEN, M_MOUNT, M_WAITOK);
-	error = copyinstr(args.fspec, fspec, MNAMELEN - 1, &size);
+	error = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
 	if (error)
 		goto error;
 	disk_map(fspec, fspec, MNAMELEN, DM_OPENBLCK);
@@ -281,17 +279,18 @@ ext2fs_mount(struct mount *mp, const char *path, void *data,
 		goto error_devvp;
 	ump = VFSTOUFS(mp);
 	fs = ump->um_e2fs;
-	(void)copyinstr(path, fs->e2fs_fsmnt, sizeof(fs->e2fs_fsmnt) - 1,
-	    &size);
-	bzero(fs->e2fs_fsmnt + size, sizeof(fs->e2fs_fsmnt) - size);
+
+	bzero(fs->e2fs_fsmnt, sizeof(fs->e2fs_fsmnt));
+	strlcpy(fs->e2fs_fsmnt, path, sizeof(fs->e2fs_fsmnt));
 	if (fs->e2fs.e2fs_rev > E2FS_REV0) {
-		(void)copystr(mp->mnt_stat.f_mntonname, fs->e2fs.e2fs_fsmnt,
-		    sizeof(fs->e2fs.e2fs_fsmnt) - 1, &size);
-		bzero(fs->e2fs.e2fs_fsmnt, sizeof(fs->e2fs.e2fs_fsmnt) - size);
+		bzero(fs->e2fs.e2fs_fsmnt, sizeof(fs->e2fs.e2fs_fsmnt));
+		strlcpy(fs->e2fs.e2fs_fsmnt, mp->mnt_stat.f_mntonname,
+		    sizeof(fs->e2fs.e2fs_fsmnt));
 	}
 	bcopy(fs->e2fs_fsmnt, mp->mnt_stat.f_mntonname, MNAMELEN);
-	size = strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN - 1);
-	bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
+	bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
+
 	if (fs->e2fs_fmod != 0) {	/* XXX */
 		fs->e2fs_fmod = 0;
 		if (fs->e2fs.e2fs_state == 0)
@@ -312,9 +311,6 @@ error:
 	/* Error with no state to backout. */
 
 success:
-	if (fspec)
-		free(fspec, M_MOUNT);
-
 	return (error);
 }
 
diff --git a/sys/ufs/ffs/ffs_vfsops.c b/sys/ufs/ffs/ffs_vfsops.c
index 619880c2803..5c9e95c972a 100644
--- a/sys/ufs/ffs/ffs_vfsops.c
+++ b/sys/ufs/ffs/ffs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ffs_vfsops.c,v 1.134 2012/06/10 21:29:04 krw Exp $	*/
+/*	$OpenBSD: ffs_vfsops.c,v 1.135 2012/09/10 11:11:00 jsing Exp $	*/
 /*	$NetBSD: ffs_vfsops.c,v 1.19 1996/02/09 22:22:26 christos Exp $	*/
 
 /*
@@ -170,11 +170,11 @@ ffs_mount(struct mount *mp, const char *path, void *data,
 	struct ufs_args args;
 	struct ufsmount *ump = NULL;
 	struct fs *fs;
+	char fspec[MNAMELEN];
 	int error = 0, flags;
 	int ronly;
 	mode_t accessmode;
 	size_t size;
-	char *fspec = NULL;
 
 	error = copyin(data, &args, sizeof (struct ufs_args));
 	if (error)
@@ -317,7 +317,7 @@ ffs_mount(struct mount *mp, const char *path, void *data,
 
 			ronly = 0;
 		}
-		if (args.fspec == 0) {
+		if (args.fspec == NULL) {
 			/*
 			 * Process export requests.
 			 */
@@ -334,8 +334,9 @@ ffs_mount(struct mount *mp, const char *path, void *data,
 	 * Not an update, or updating the name: look up the name
 	 * and verify that it refers to a sensible block device.
 	 */
-	fspec = malloc(MNAMELEN, M_MOUNT, M_WAITOK);
-	copyinstr(args.fspec, fspec, MNAMELEN - 1, &size);
+	error = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
+	if (error)
+		goto error_1; 
 	disk_map(fspec, fspec, MNAMELEN, DM_OPENBLCK);
 
 	NDINIT(ndp, LOOKUP, FOLLOW, UIO_SYSSPACE, fspec, p);
@@ -403,16 +404,10 @@ ffs_mount(struct mount *mp, const char *path, void *data,
 		 * error occurs,  the mountpoint is discarded by the
 		 * upper level code.
 		 */
-		/* Save "last mounted on" info for mount point (NULL pad)*/
-		copyinstr(path,				/* mount point*/
-			  mp->mnt_stat.f_mntonname,	/* save area*/
-			  MNAMELEN - 1,			/* max size*/
-			  &size);			/* real size*/
-		bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
-
-		/* Save "mounted from" info for mount point (NULL pad)*/
-		size = strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN - 1);
-		bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
+		bzero(mp->mnt_stat.f_mntonname, MNAMELEN);
+		strlcpy(mp->mnt_stat.f_mntonname, path, MNAMELEN);
+		bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+		strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
 
 		error = ffs_mountfs(devvp, mp, p);
 	}
@@ -427,7 +422,7 @@ ffs_mount(struct mount *mp, const char *path, void *data,
 	 * This code is common to root and non-root mounts
 	 */
 	bcopy(&args, &mp->mnt_stat.mount_info.ufs_args, sizeof(args));
-	(void)VFS_STATFS(mp, &mp->mnt_stat, p);
+	VFS_STATFS(mp, &mp->mnt_stat, p);
 
 success:
 	if (path && (mp->mnt_flag & MNT_UPDATE)) {
@@ -454,10 +449,6 @@ error_2:	/* error with devvp held */
 	vrele (devvp);
 
 error_1:	/* no state to back out */
-
-	if (fspec)
-		free(fspec, M_MOUNT);
-
 	return (error);
 }
 
diff --git a/sys/ufs/mfs/mfs_vfsops.c b/sys/ufs/mfs/mfs_vfsops.c
index ab362a02ef8..29a941d5b94 100644
--- a/sys/ufs/mfs/mfs_vfsops.c
+++ b/sys/ufs/mfs/mfs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mfs_vfsops.c,v 1.42 2010/12/21 20:14:44 thib Exp $	*/
+/*	$OpenBSD: mfs_vfsops.c,v 1.43 2012/09/10 11:11:00 jsing Exp $	*/
 /*	$NetBSD: mfs_vfsops.c,v 1.10 1996/02/09 22:31:28 christos Exp $	*/
 
 /*
@@ -91,10 +91,10 @@ mfs_mount(struct mount *mp, const char *path, void *data,
 	struct ufsmount *ump;
 	struct fs *fs;
 	struct mfsnode *mfsp;
-	size_t size;
+	char fspec[MNAMELEN];
 	int flags, error;
 
-	error = copyin(data, (caddr_t)&args, sizeof (struct mfs_args));
+	error = copyin(data, (caddr_t)&args, sizeof(struct mfs_args));
 	if (error)
 		return (error);
 
@@ -116,12 +116,15 @@ mfs_mount(struct mount *mp, const char *path, void *data,
 		if (fs->fs_ronly && (mp->mnt_flag & MNT_WANTRDWR))
 			fs->fs_ronly = 0;
 #ifdef EXPORTMFS
-		if (args.fspec == 0)
+		if (args.fspec == NULL)
 			return (vfs_export(mp, &ump->um_export, 
 			    &args.export_info));
 #endif
 		return (0);
 	}
+	error = copyinstr(args.fspec, fspec, sizeof(fspec), NULL);
+	if (error)
+		return (error);
 	error = getnewvnode(VT_MFS, NULL, &mfs_vops, &devvp);
 	if (error)
 		return (error);
@@ -143,13 +146,14 @@ mfs_mount(struct mount *mp, const char *path, void *data,
 	}
 	ump = VFSTOUFS(mp);
 	fs = ump->um_fs;
-	(void) copyinstr(path, fs->fs_fsmnt, sizeof(fs->fs_fsmnt) - 1, &size);
-	bzero(fs->fs_fsmnt + size, sizeof(fs->fs_fsmnt) - size);
+
+	bzero(fs->fs_fsmnt, sizeof(fs->fs_fsmnt));
+	strlcpy(fs->fs_fsmnt, path, sizeof(fs->fs_fsmnt));
 	bcopy(fs->fs_fsmnt, mp->mnt_stat.f_mntonname, MNAMELEN);
-	(void) copyinstr(args.fspec, mp->mnt_stat.f_mntfromname, MNAMELEN - 1,
-	    &size);
-	bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
+	bzero(mp->mnt_stat.f_mntfromname, MNAMELEN);
+	strlcpy(mp->mnt_stat.f_mntfromname, fspec, MNAMELEN);
 	bcopy(&args, &mp->mnt_stat.mount_info.mfs_args, sizeof(args));
+
 	return (0);
 }