Re: kern/38336: NULL deref in nfs_lookup

[yamt%mwd.biglobe.ne.jp@localhost (YAMAMOTO Takashi)]

> nfs_vnops.c:
> 
>     925       nfsm_request(np, NFSPROC_LOOKUP, curlwp, cnp->cn_cred);
>     926       if (error) {
>     927               nfsm_postop_attr(dvp, attrflag, 0);
>     928               m_freem(mrep);
>     929               goto nfsmout;
>     930       }
> 
> nfsm_request() fills 'error' and typically 'md'. In case of error,
> 'md' is sometimes not filled and can contain junk from the stack,
> but nfsm_postop_attr() assumes that 'md' is always filled. Here is 

can you be specific about "sometimes"?
unless NFSERR_RETERR is set, nfsm_request macro itself does "goto nfsmout"
so "if (error)" in the above code is not executed.

YAMAMOTO Takashi