kext: sysfs_vfsops: fix hash table buckets allocation leak across mounts/unmounts

In sysfs_vfsops.c, sfsnode_hash_buckets is allocated on the first mount using hashinit().

During sysfs_unmount() or sysfs_structure_free(), sfsnode_hash_buckets is never
deallocated (e.g., using hashdestroy() / FREE()). If the kernel module is unmounted,
or if sfsnode_hash_buckets is meant to be tied to module lifespan, the memory allocated
by hashinit remains leaked on unload

Call hashdestroy(sfsnode_hash_buckets, M_CACHE, sfsnode_hash_to_bucket_mask) during
teardown/unmount when the mounted instance count drops to zero.

Author: somestupidgirl

kext/sysfs_vfsops.c

@@ -244,9 +244,20 @@ sysfs_unmount(struct mount *mp, __unused int mntflags, __unused vfs_context_t co
         sysfs_mp = NULL;
 
         /*
-         * Decrement mounted instance count.
+         * Decrement mounted instance count atomically and check 
+         * if this was the last active mount.
          */
-        OSAddAtomic(-1, &mounted_instance_count);
+        if (OSAddAtomic(-1, &mounted_instance_count) == 1) {
+            /*
+             * OSAddAtomic returns the value PRIOR to the subtraction.
+             * If the returned value was 1, count is now 0.
+             * Safe to tear down the shared hash table!
+             */
+            if (sfsnode_hash_buckets != NULL) {
+                hashdestroy(sfsnode_hash_buckets, M_CACHE, sfsnode_hash_to_bucket_mask);
+                sfsnode_hash_buckets = NULL;
+            }
+        }
     }
     sysfs_structure_free();