Make sure file after VOP_OPEN is VMIO'd when transfering control from

    a lower layer to an upper layer.  I'm not sure how necessary this is
    for reading.

    Fix bug in union_lookup() (note: there are probably still several bugs
    in union_lookup()).  This one set lerror as a side effect without
    setting lowervp, causing copyup code further on down to crash on a null
    lowervp pointer.  Changed the side effect to use a temporary variable
    instead.

2 files changed, 8 insertions, 4 deletions

diff --git a/sys/miscfs/union/union_subr.c b/sys/miscfs/union/union_subr.c
index c03153c..7c3dbb9 100644
--- a/sys/miscfs/union/union_subr.c
+++ b/sys/miscfs/union/union_subr.c
@@ -807,8 +807,10 @@ union_copyup(un, docopy, cred, p)
 			(void) VOP_CLOSE(lvp, FREAD, cred, p);
 			(void) VOP_OPEN(uvp, FREAD, cred, p);
 		}
-		if (vn_canvmio(uvp) == TRUE)
-			error = vfs_object_create(uvp, p, cred);
+		if (un->un_openl) {
+			if (vn_canvmio(uvp) == TRUE)
+				error = vfs_object_create(uvp, p, cred);
+		}
 		un->un_openl = 0;
 	}
 
diff --git a/sys/miscfs/union/union_vnops.c b/sys/miscfs/union/union_vnops.c
index 128e59e..0be000d 100644
--- a/sys/miscfs/union/union_vnops.c
+++ b/sys/miscfs/union/union_vnops.c
@@ -404,9 +404,11 @@ union_lookup(ap)
 			if (cnp->cn_flags & ISWHITEOUT) {
 				iswhiteout = 1;
 			} else if (lowerdvp != NULLVP) {
-				lerror = VOP_GETATTR(upperdvp, &va,
+				int terror;
+
+				terror = VOP_GETATTR(upperdvp, &va,
 					cnp->cn_cred, cnp->cn_proc);
-				if (lerror == 0 && (va.va_flags & OPAQUE))
+				if (terror == 0 && (va.va_flags & OPAQUE))
 					iswhiteout = 1;
 			}
 		}