Fake up a struct componentname to pass to VOP_WHITEOUT instead of passing

NULL. union_whiteout() expects the componentname argument to be non-NULL.
Fixes a NULL dereference panic when an existing union mount becomes the
upper layer of a new union mount.

1 files changed, 10 insertions, 1 deletions

diff --git a/sys/fs/unionfs/union_vfsops.c b/sys/fs/unionfs/union_vfsops.c
index a25075c..637b350 100644
--- a/sys/fs/unionfs/union_vfsops.c
+++ b/sys/fs/unionfs/union_vfsops.c
@@ -85,6 +85,7 @@ union_mount(mp, ndp, td)
 	int op;
 	int len;
 	size_t size;
+	struct componentname fakecn;
 
 	UDEBUG(("union_mount(mp = %p)\n", (void *)mp));
 
@@ -230,7 +231,15 @@ union_mount(mp, ndp, td)
 	 * supports whiteout operations.
 	 */
 	if ((mp->mnt_flag & MNT_RDONLY) == 0) {
-		error = VOP_WHITEOUT(um->um_uppervp, NULL, LOOKUP);
+		/*
+		 * XXX Fake up a struct componentname with only cn_nameiop
+		 * and cn_thread valid; union_whiteout() needs to use the
+		 * thread pointer to lock the vnode.
+		 */
+		bzero(&fakecn, sizeof(fakecn));
+		fakecn.cn_nameiop = LOOKUP;
+		fakecn.cn_thread = td;
+		error = VOP_WHITEOUT(um->um_uppervp, &fakecn, LOOKUP);
 		if (error)
 			goto bad;
 	}