From b69aa7f11a8e72f48cb06815798595227c9ac051 Mon Sep 17 00:00:00 2001
From: KATO Takenori <kato@FreeBSD.org>
Date: Wed, 16 Apr 1997 16:24:24 +0000
Subject: [PATCH] Do not set the uppervp to NULLVP in union_removed_upper.  If
 lowervp is NULLVP, union node will have neither uppervp nor lowervp.  This
 causes page fault trap.

The union_removed_upper just remove union node from cache and it
doesn't set uppervp to NULLVP.  Since union node is removed from
cache, it will not be referenced.

The code that remove union node from cache was copied from
union_inactive.
---
 sys/fs/unionfs/union_subr.c   | 17 ++++++++++++++++-
 sys/miscfs/union/union_subr.c | 17 ++++++++++++++++-
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/sys/fs/unionfs/union_subr.c b/sys/fs/unionfs/union_subr.c
index e37593d8fd99..b05197ca9bed 100644
--- a/sys/fs/unionfs/union_subr.c
+++ b/sys/fs/unionfs/union_subr.c
@@ -35,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)union_subr.c	8.20 (Berkeley) 5/20/95
- * $Id: union_subr.c,v 1.16 1997/04/13 06:25:03 phk Exp $
+ * $Id: union_subr.c,v 1.17 1997/04/13 06:27:09 phk Exp $
  */
 
 #include <sys/param.h>
@@ -971,8 +971,23 @@ union_removed_upper(un)
 	struct union_node *un;
 {
 	struct proc *p = curproc;	/* XXX */
+	struct vnode **vpp;
 
+	/*
+	 * Do not set the uppervp to NULLVP.  If lowervp is NULLVP,
+	 * union node will have neither uppervp nor lowervp.  We romove
+	 * the union node from cache, so that it will not be referrenced.
+	 */
+#if 0
 	union_newupper(un, NULLVP);
+#endif
+	if (un->un_dircache != 0) {
+		for (vpp = un->un_dircache; *vpp != NULLVP; vpp++)
+			vrele(*vpp);
+		free(un->un_dircache, M_TEMP);
+		un->un_dircache = 0;
+	}
+
 	if (un->un_flags & UN_CACHED) {
 		un->un_flags &= ~UN_CACHED;
 		LIST_REMOVE(un, un_cache);
diff --git a/sys/miscfs/union/union_subr.c b/sys/miscfs/union/union_subr.c
index e37593d8fd99..b05197ca9bed 100644
--- a/sys/miscfs/union/union_subr.c
+++ b/sys/miscfs/union/union_subr.c
@@ -35,7 +35,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)union_subr.c	8.20 (Berkeley) 5/20/95
- * $Id: union_subr.c,v 1.16 1997/04/13 06:25:03 phk Exp $
+ * $Id: union_subr.c,v 1.17 1997/04/13 06:27:09 phk Exp $
  */
 
 #include <sys/param.h>
@@ -971,8 +971,23 @@ union_removed_upper(un)
 	struct union_node *un;
 {
 	struct proc *p = curproc;	/* XXX */
+	struct vnode **vpp;
 
+	/*
+	 * Do not set the uppervp to NULLVP.  If lowervp is NULLVP,
+	 * union node will have neither uppervp nor lowervp.  We romove
+	 * the union node from cache, so that it will not be referrenced.
+	 */
+#if 0
 	union_newupper(un, NULLVP);
+#endif
+	if (un->un_dircache != 0) {
+		for (vpp = un->un_dircache; *vpp != NULLVP; vpp++)
+			vrele(*vpp);
+		free(un->un_dircache, M_TEMP);
+		un->un_dircache = 0;
+	}
+
 	if (un->un_flags & UN_CACHED) {
 		un->un_flags &= ~UN_CACHED;
 		LIST_REMOVE(un, un_cache);