Back out changes to symlink and mknod that were not well tested.

A simple mknod at causes a kernel panic (uvm_fault).

2 files changed, 44 insertions, 31 deletions

diff --git a/sys/nfs/nfs_serv.c b/sys/nfs/nfs_serv.c
index efd9972dd9c..0fadf687f7b 100644
--- a/sys/nfs/nfs_serv.c
+++ b/sys/nfs/nfs_serv.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_serv.c,v 1.25 2001/07/26 02:10:41 assar Exp $	*/
+/*	$OpenBSD: nfs_serv.c,v 1.26 2001/07/26 20:24:47 millert Exp $	*/
 /*     $NetBSD: nfs_serv.c,v 1.34 1997/05/12 23:37:12 fvdl Exp $       */
 
 /*
@@ -1362,6 +1362,16 @@ nfsrv_create(nfsd, slp, procp, mrq)
 				nfsm_reply(0);
 				return (0);
 			}
+			nd.ni_cnd.cn_nameiop = LOOKUP;
+			nd.ni_cnd.cn_flags &= ~(LOCKPARENT | SAVESTART);
+			nd.ni_cnd.cn_proc = procp;
+			nd.ni_cnd.cn_cred = cred;
+			if ((error = lookup(&nd)) != 0) {
+				free(nd.ni_cnd.cn_pnbuf, M_NAMEI);
+				nfsm_reply(0);
+				return (0);
+			}
+			
 			FREE(nd.ni_cnd.cn_pnbuf, M_NAMEI);
 			if (nd.ni_cnd.cn_flags & ISSYMLINK) {
 				vrele(nd.ni_dvp);
@@ -1544,7 +1554,14 @@ nfsrv_mknod(nfsd, slp, procp, mrq)
 			vrele(nd.ni_startdir);
 			goto out;
 		}
+		nd.ni_cnd.cn_nameiop = LOOKUP;
+		nd.ni_cnd.cn_flags &= ~(LOCKPARENT | SAVESTART);
+		nd.ni_cnd.cn_proc = procp;
+		nd.ni_cnd.cn_cred = procp->p_ucred;
+		error = lookup(&nd);
 		FREE(nd.ni_cnd.cn_pnbuf, M_NAMEI);
+		if (error)
+			goto out;
 		if (nd.ni_cnd.cn_flags & ISSYMLINK) {
 			vrele(nd.ni_dvp);
 			vput(nd.ni_vp);
@@ -2035,17 +2052,23 @@ nfsrv_symlink(nfsd, slp, procp, mrq)
 		vrele(nd.ni_startdir);
 	else {
 	    if (v3) {
-		    bzero((caddr_t)fhp, sizeof(nfh));
-		    fhp->fh_fsid = nd.ni_vp->v_mount->mnt_stat.f_fsid;
-		    error = VFS_VPTOFH(nd.ni_vp, &fhp->fh_fid);
-		    if (!error)
-			    error = VOP_GETATTR(nd.ni_vp, &va, cred,
-						procp);
-		    vput(nd.ni_vp);
-	    } else {
+		nd.ni_cnd.cn_nameiop = LOOKUP;
+		nd.ni_cnd.cn_flags &= ~(LOCKPARENT | SAVESTART | FOLLOW);
+		nd.ni_cnd.cn_flags |= (NOFOLLOW | LOCKLEAF);
+		nd.ni_cnd.cn_proc = procp;
+		nd.ni_cnd.cn_cred = cred;
+		error = lookup(&nd);
+		if (!error) {
+			bzero((caddr_t)fhp, sizeof(nfh));
+			fhp->fh_fsid = nd.ni_vp->v_mount->mnt_stat.f_fsid;
+			error = VFS_VPTOFH(nd.ni_vp, &fhp->fh_fid);
+			if (!error)
+				error = VOP_GETATTR(nd.ni_vp, &va, cred,
+					procp);
+			vput(nd.ni_vp);
+		}
+	    } else
 		vrele(nd.ni_startdir);
-		vput(nd.ni_vp);
-	    }
 	    FREE(nd.ni_cnd.cn_pnbuf, M_NAMEI);
 	}
 out:
diff --git a/sys/nfs/nfs_vnops.c b/sys/nfs/nfs_vnops.c
index c1bee0c45fb..f189a448a73 100644
--- a/sys/nfs/nfs_vnops.c
+++ b/sys/nfs/nfs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_vnops.c,v 1.36 2001/07/26 02:10:41 assar Exp $	*/
+/*	$OpenBSD: nfs_vnops.c,v 1.37 2001/07/26 20:24:47 millert Exp $	*/
 /*	$NetBSD: nfs_vnops.c,v 1.62.4.1 1996/07/08 20:26:52 jtc Exp $	*/
 
 /*
@@ -1155,6 +1155,8 @@ nfs_mknod(v)
 	int error;
 
 	error = nfs_mknodrpc(ap->a_dvp, &newvp, ap->a_cnp, ap->a_vap);
+	if (!error)
+		vrele(newvp);
 	return (error);
 }
 
@@ -1631,30 +1633,18 @@ nfs_symlink(v)
 		nfsm_wcc_data(dvp, wccflag);
 	}
 	nfsm_reqdone;
-	/*
-	 * Kludge: Map EEXIST => 0 assuming that it is a reply to a retry.
-	 */
-	if (error == EEXIST)
-		error = 0;
-	if (error == 0 && newvp == NULL) {
-		struct nfsnode *np = NULL;
-
-		error = nfs_lookitup(dvp, cnp->cn_nameptr, cnp->cn_namelen,
-		    cnp->cn_cred, cnp->cn_proc, &np);
-		if (error == 0)
-			newvp = NFSTOV(np);
-	}
-	if (error) {
-		if (newvp != NULL)
-			vput(newvp);
-	} else {
-		*ap->a_vpp = newvp;
-	}
+	if (newvp)
+		vrele(newvp);
 	FREE(cnp->cn_pnbuf, M_NAMEI);
 	VTONFS(dvp)->n_flag |= NMODIFIED;
 	if (!wccflag)
 		VTONFS(dvp)->n_attrstamp = 0;
 	vrele(dvp);
+	/*
+	 * Kludge: Map EEXIST => 0 assuming that it is a reply to a retry.
+	 */
+	if (error == EEXIST)
+		error = 0;
 	return (error);
 }