In namei(), we use a NULL thread for uio_td when doing a VOP_READLINK().

nfs_readlink() calls nfs_bioread() which passes in uio_td as the thread
argument to nfs_getcacheblk().  In nfs_getcacheblk() we dereference the
thread pointer to get a process pointer to pass to nfs_sigintr().  This
obviously results in a panic. :)

Rather than change nfs_getcacheblk() to check if the thread pointer is
NULL when calling nfs_sigintr() like other callers do, change
nfs_sigintr() to take a thread as the last argument instead of a
process so none of the callers have to care if the thread is NULL or not.

1 files changed, 2 insertions, 2 deletions

diff --git a/sys/nfsclient/nfs_vnops.c b/sys/nfsclient/nfs_vnops.c
index d9bdcea..c1daf57 100644
--- a/sys/nfsclient/nfs_vnops.c
+++ b/sys/nfsclient/nfs_vnops.c
@@ -2776,7 +2776,7 @@ loop:
 				panic("nfs_fsync: inconsistent lock");
 			if (error == ENOLCK)
 				goto loop;
-			if (nfs_sigintr(nmp, (struct nfsreq *)0, td->td_proc)) {
+			if (nfs_sigintr(nmp, (struct nfsreq *)0, td)) {
 				error = EINTR;
 				goto done;
 			}
@@ -2812,7 +2812,7 @@ loop:
 			error = tsleep((caddr_t)&vp->v_numoutput,
 				slpflag | (PRIBIO + 1), "nfsfsync", slptimeo);
 			if (error) {
-			    if (nfs_sigintr(nmp, (struct nfsreq *)0, td->td_proc)) {
+			    if (nfs_sigintr(nmp, (struct nfsreq *)0, td)) {
 				error = EINTR;
 				goto done;
 			    }