Store a reference to the parent directory's vnode in struct smbnode,

not to the parent's smbnode, which may be freed during the lifetime
of the child if the mount is forcibly unmounted. umount -f should now
work properly (ie. not panic) on smbfs mounts.

1 files changed, 5 insertions, 5 deletions

diff --git a/sys/fs/smbfs/smbfs_node.c b/sys/fs/smbfs/smbfs_node.c
index c94787d..7f17967 100644
--- a/sys/fs/smbfs/smbfs_node.c
+++ b/sys/fs/smbfs/smbfs_node.c
@@ -180,7 +180,7 @@ smbfs_node_alloc(struct mount *mp, struct vnode *dvp,
 	if (nmlen == 2 && bcmp(name, "..", 2) == 0) {
 		if (dvp == NULL)
 			return EINVAL;
-		vp = VTOSMB(dvp)->n_parent->n_vnode;
+		vp = VTOSMB(VTOSMB(dvp)->n_parent)->n_vnode;
 		error = vget(vp, LK_EXCLUSIVE, td);
 		if (error == 0)
 			*vpp = vp;
@@ -201,7 +201,7 @@ loop:
 	nhpp = SMBFS_NOHASH(smp, hashval);
 	LIST_FOREACH(np, nhpp, n_hash) {
 		vp = SMBTOV(np);
-		if (np->n_parent != dnp ||
+		if (np->n_parent != dvp ||
 		    np->n_nmlen != nmlen || bcmp(name, np->n_name, nmlen) != 0)
 			continue;
 		VI_LOCK(vp);
@@ -236,7 +236,7 @@ loop:
 
 	if (dvp) {
 		ASSERT_VOP_LOCKED(dvp, "smbfs_node_alloc");
-		np->n_parent = dnp;
+		np->n_parent = dvp;
 		if (/*vp->v_type == VDIR &&*/ (dvp->v_vflag & VV_ROOT) == 0) {
 			vref(dvp);
 			np->n_flag |= NREFPARENT;
@@ -249,7 +249,7 @@ loop:
 
 	smbfs_hash_lock(smp, td);
 	LIST_FOREACH(np2, nhpp, n_hash) {
-		if (np2->n_parent != dnp ||
+		if (np2->n_parent != dvp ||
 		    np2->n_nmlen != nmlen || bcmp(name, np2->n_name, nmlen) != 0)
 			continue;
 		vput(vp);
@@ -303,7 +303,7 @@ smbfs_reclaim(ap)
 	smbfs_hash_lock(smp, td);
 
 	dvp = (np->n_parent && (np->n_flag & NREFPARENT)) ?
-	    np->n_parent->n_vnode : NULL;
+	    np->n_parent : NULL;
 
 	if (np->n_hash.le_prev)
 		LIST_REMOVE(np, n_hash);