NFS experts: stale vnode pointer in ufs_fhtovp ?

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

Hello,
today there was 2 identical panics on a NFS server:
uvm_fault(0xcad9c91c, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c02ccc89 cs 8 eflags 10246 cr2 80 ilevel 0
kernel: supervisor trap page fault, code=0
Stopped in pid 235.9 (nfsd) at  netbsd:ufs_fhtovp+0x59: cmpw    $0,0x80(%eax)

unfortunably the admins which rebooted it didn't get a stack trace.
The code looks like:
(gdb) l *(ufs_fhtovp+0x59)
0xc02ccc89 is in ufs_fhtovp 
(/home/bouyer/src-5/src/sys/ufs/ufs/ufs_vfsops.c:192).
187             if ((error = VFS_VGET(mp, ufhp->ufid_ino, &nvp)) != 0) {
188                     *vpp = NULLVP;
189                     return (error);
190             }
191             ip = VTOI(nvp);
192             if (ip->i_mode == 0 || ip->i_gen != ufhp->ufid_gen) {
193                     vput(nvp);
194                     *vpp = NULLVP;
195                     return (ESTALE);
196             }

It paniced because ip was NULL (cmpw   $0,0x80(%eax) is ip->i_mode == 0). 
Should line 192 be changed to
if (ip == NULL || ip->i_mode == 0 || ip->i_gen != ufhp->ufid_gen) {
or is there something wrong at another level ?

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--