implement new access policy

fixup locking for UNMNT_BELOW.

SCCS-vsn: sys/miscfs/union/union.h 8.2
SCCS-vsn: sys/miscfs/union/union_subr.c 8.4
SCCS-vsn: sys/miscfs/union/union_vnops.c 8.6
SCCS-vsn: sys/miscfs/union/union_vfsops.c 8.4

diff --git a/usr/src/sys/miscfs/union/union.h b/usr/src/sys/miscfs/union/union.h
index 3cee6eb..7a51c07 100644 (file)
--- a/usr/src/sys/miscfs/union/union.h
+++ b/usr/src/sys/miscfs/union/union.h
@@ -8,7 +8,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)union.h     8.1 (Berkeley) %G%
+ *     @(#)union.h     8.2 (Berkeley) %G%

  */
 
 struct union_args {
  */
 
 struct union_args {


@@ -26,6 +26,7 @@ struct union_mount {
        struct vnode    *um_lowervp;
        struct ucred    *um_cred;       /* Credentials of user calling mount */
        int             um_cmode;       /* cmask from mount process */
        struct vnode    *um_lowervp;
        struct ucred    *um_cred;       /* Credentials of user calling mount */
        int             um_cmode;       /* cmask from mount process */

+       int             um_op;          /* Operation mode */

 };
 
 #ifdef KERNEL
 };
 
 #ifdef KERNEL

diff --git a/usr/src/sys/miscfs/union/union_subr.c b/usr/src/sys/miscfs/union/union_subr.c
index eae9bff..9e444c7 100644 (file)
--- a/usr/src/sys/miscfs/union/union_subr.c
+++ b/usr/src/sys/miscfs/union/union_subr.c
@@ -8,7 +8,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)union_subr.c        8.3 (Berkeley) %G%
+ *     @(#)union_subr.c        8.4 (Berkeley) %G%

  */
 
 #include <sys/param.h>
  */
 
 #include <sys/param.h>


@@ -558,7 +558,10 @@ union_mkshadow(um, dvp, cnp, vpp)
        cn.cn_nameiop = CREATE;
        cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN);
        cn.cn_proc = cnp->cn_proc;
        cn.cn_nameiop = CREATE;
        cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN);
        cn.cn_proc = cnp->cn_proc;

-       cn.cn_cred = um->um_cred;
+       if (um->um_op == UNMNT_ABOVE)
+               cn.cn_cred = cnp->cn_cred;
+       else
+               cn.cn_cred = um->um_cred;

        cn.cn_nameptr = cn.cn_pnbuf;
        cn.cn_namelen = cnp->cn_namelen;
        cn.cn_hash = cnp->cn_hash;
        cn.cn_nameptr = cn.cn_pnbuf;
        cn.cn_namelen = cnp->cn_namelen;
        cn.cn_hash = cnp->cn_hash;

diff --git a/usr/src/sys/miscfs/union/union_vfsops.c b/usr/src/sys/miscfs/union/union_vfsops.c
index 5b06696..55fff01 100644 (file)
--- a/usr/src/sys/miscfs/union/union_vfsops.c
+++ b/usr/src/sys/miscfs/union/union_vfsops.c
@@ -8,7 +8,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)union_vfsops.c      8.3 (Berkeley) %G%
+ *     @(#)union_vfsops.c      8.4 (Berkeley) %G%

  */
 
 /*
  */
 
 /*


@@ -45,6 +45,7 @@ union_mount(mp, path, data, ndp, p)
        struct vnode *upperrootvp = NULLVP;
        struct union_mount *um;
        struct ucred *cred = 0;
        struct vnode *upperrootvp = NULLVP;
        struct union_mount *um;
        struct ucred *cred = 0;

+       struct vattr va;

        char *cp;
        int len;
        u_int size;
        char *cp;
        int len;
        u_int size;


@@ -80,11 +81,20 @@ union_mount(mp, path, data, ndp, p)
         * mounted-on directory.  This allows the mount_union
         * command to be made setuid root so allowing anyone
         * to do union mounts onto any directory on which they
         * mounted-on directory.  This allows the mount_union
         * command to be made setuid root so allowing anyone
         * to do union mounts onto any directory on which they

-        * have write permission.
+        * have write (also delete and rename) permission.

         */
        error = VOP_ACCESS(mp->mnt_vnodecovered, VWRITE, cred, p);
        if (error)
                goto bad;
         */
        error = VOP_ACCESS(mp->mnt_vnodecovered, VWRITE, cred, p);
        if (error)
                goto bad;

+       error = VOP_GETATTR(mp->mnt_vnodecovered, &va, cred, p);
+       if (error)
+               goto bad;
+       if ((va.va_mode & VSVTX) &&
+           (va.va_uid != 0) &&
+           (va.va_uid != cred->cr_uid)) {
+               error = EACCES;
+               goto bad;
+       }

 
        /*
         * Get argument
 
        /*
         * Get argument


@@ -124,7 +134,8 @@ union_mount(mp, path, data, ndp, p)
         * same as providing a mount under option to the mount syscall.
         */
 
         * same as providing a mount under option to the mount syscall.
         */
 

-       switch (args.mntflags & UNMNT_OPMASK) {
+       um->um_op = args.mntflags & UNMNT_OPMASK;
+       switch (um->um_op) {

        case UNMNT_ABOVE:
                um->um_lowervp = lowerrootvp;
                um->um_uppervp = upperrootvp;
        case UNMNT_ABOVE:
                um->um_lowervp = lowerrootvp;
                um->um_uppervp = upperrootvp;


@@ -159,10 +170,12 @@ union_mount(mp, path, data, ndp, p)
         * flag implies that some of the files might be stored locally
         * then you will want to change the conditional.
         */
         * flag implies that some of the files might be stored locally
         * then you will want to change the conditional.
         */

-       if (((um->um_lowervp == NULLVP) ||
-            (um->um_lowervp->v_mount->mnt_flag & MNT_LOCAL)) &&
-           (um->um_uppervp->v_mount->mnt_flag & MNT_LOCAL))
-               mp->mnt_flag |= MNT_LOCAL;
+       if (um->um_op == UNMNT_ABOVE) {
+               if (((um->um_lowervp == NULLVP) ||
+                    (um->um_lowervp->v_mount->mnt_flag & MNT_LOCAL)) &&
+                   (um->um_uppervp->v_mount->mnt_flag & MNT_LOCAL))
+                       mp->mnt_flag |= MNT_LOCAL;
+       }

 
        /*
         * Copy in the upper layer's RDONLY flag.  This is for the benefit
 
        /*
         * Copy in the upper layer's RDONLY flag.  This is for the benefit


@@ -178,7 +191,7 @@ union_mount(mp, path, data, ndp, p)
        (void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &size);
        bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
 
        (void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &size);
        bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
 

-       switch (args.mntflags & UNMNT_OPMASK) {
+       switch (um->um_op) {

        case UNMNT_ABOVE:
                cp = "un-above:";
                break;
        case UNMNT_ABOVE:
                cp = "un-above:";
                break;


@@ -299,6 +312,7 @@ union_root(mp, vpp)
 {
        struct union_mount *um = MOUNTTOUNIONMOUNT(mp);
        int error;
 {
        struct union_mount *um = MOUNTTOUNIONMOUNT(mp);
        int error;

+       int loselock;

 
 #ifdef UNION_DIAGNOSTIC
        printf("union_root(mp = %x, lvp = %x, uvp = %x)\n", mp,
 
 #ifdef UNION_DIAGNOSTIC
        printf("union_root(mp = %x, lvp = %x, uvp = %x)\n", mp,


@@ -310,7 +324,13 @@ union_root(mp, vpp)
         * Return locked reference to root.
         */
        VREF(um->um_uppervp);
         * Return locked reference to root.
         */
        VREF(um->um_uppervp);

-       VOP_LOCK(um->um_uppervp);
+       if ((um->um_op == UNMNT_BELOW) &&
+            VOP_ISLOCKED(um->um_uppervp)) {
+               loselock = 1;
+       } else {
+               VOP_LOCK(um->um_uppervp);
+               loselock = 0;
+       }

        if (um->um_lowervp)
                VREF(um->um_lowervp);
        error = union_allocvp(vpp, mp,
        if (um->um_lowervp)
                VREF(um->um_lowervp);
        error = union_allocvp(vpp, mp,


@@ -321,11 +341,15 @@ union_root(mp, vpp)
                              um->um_lowervp);
 
        if (error) {
                              um->um_lowervp);
 
        if (error) {

+               if (!loselock)
+                       VOP_UNLOCK(um->um_uppervp);

                vrele(um->um_uppervp);
                if (um->um_lowervp)
                        vrele(um->um_lowervp);
        } else {
                (*vpp)->v_flag |= VROOT;
                vrele(um->um_uppervp);
                if (um->um_lowervp)
                        vrele(um->um_lowervp);
        } else {
                (*vpp)->v_flag |= VROOT;

+               if (loselock)
+                       VTOUNION(*vpp)->un_flags &= ~UN_ULOCK;

        }
 
        return (error);
        }
 
        return (error);

diff --git a/usr/src/sys/miscfs/union/union_vnops.c b/usr/src/sys/miscfs/union/union_vnops.c
index be50978..7766a4a 100644 (file)
--- a/usr/src/sys/miscfs/union/union_vnops.c
+++ b/usr/src/sys/miscfs/union/union_vnops.c
@@ -8,7 +8,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)union_vnops.c       8.5 (Berkeley) %G%
+ *     @(#)union_vnops.c       8.6 (Berkeley) %G%

  */
 
 #include <sys/param.h>
  */
 
 #include <sys/param.h>


@@ -25,6 +25,21 @@
 #include <sys/queue.h>
 #include <miscfs/union/union.h>
 
 #include <sys/queue.h>
 #include <miscfs/union/union.h>
 

+#define FIXUP(un) { \
+       if (((un)->un_flags & UN_ULOCK) == 0) { \
+               union_fixup(un); \
+       } \
+}
+
+static void
+union_fixup(un)
+       struct union_node *un;
+{
+
+       VOP_LOCK(un->un_uppervp);
+       un->un_flags |= UN_ULOCK;
+}
+

 static int
 union_lookup1(udvp, dvp, vpp, cnp)
        struct vnode *udvp;
 static int
 union_lookup1(udvp, dvp, vpp, cnp)
        struct vnode *udvp;


@@ -121,6 +136,7 @@ union_lookup(ap)
        int lockparent = cnp->cn_flags & LOCKPARENT;
        int rdonly = cnp->cn_flags & RDONLY;
        struct union_mount *um = MOUNTTOUNIONMOUNT(dvp->v_mount);
        int lockparent = cnp->cn_flags & LOCKPARENT;
        int rdonly = cnp->cn_flags & RDONLY;
        struct union_mount *um = MOUNTTOUNIONMOUNT(dvp->v_mount);

+       struct ucred *saved_cred;

 
        cnp->cn_flags |= LOCKPARENT;
 
 
        cnp->cn_flags |= LOCKPARENT;
 


@@ -136,6 +152,7 @@ union_lookup(ap)
         * on and just return that vnode.
         */
        if (upperdvp) {
         * on and just return that vnode.
         */
        if (upperdvp) {

+               FIXUP(dun);

                uerror = union_lookup1(um->um_uppervp, upperdvp,
                                        &uppervp, cnp);
                /*if (uppervp == upperdvp)
                uerror = union_lookup1(um->um_uppervp, upperdvp,
                                        &uppervp, cnp);
                /*if (uppervp == upperdvp)


@@ -169,8 +186,14 @@ union_lookup(ap)
                 */
                nameiop = cnp->cn_nameiop;
                cnp->cn_nameiop = LOOKUP;
                 */
                nameiop = cnp->cn_nameiop;
                cnp->cn_nameiop = LOOKUP;

+               if (um->um_op == UNMNT_BELOW) {
+                       saved_cred = cnp->cn_cred;
+                       cnp->cn_cred = um->um_cred;
+               }

                lerror = union_lookup1(um->um_lowervp, lowerdvp,
                                &lowervp, cnp);
                lerror = union_lookup1(um->um_lowervp, lowerdvp,
                                &lowervp, cnp);

+               if (um->um_op == UNMNT_BELOW)
+                       cnp->cn_cred = saved_cred;

                cnp->cn_nameiop = nameiop;
 
                if (lowervp != lowerdvp)
                cnp->cn_nameiop = nameiop;
 
                if (lowervp != lowerdvp)


@@ -282,6 +305,8 @@ union_create(ap)
                int error;
                struct vnode *vp;
 
                int error;
                struct vnode *vp;
 

+               FIXUP(un);
+

                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);
                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);


@@ -322,6 +347,8 @@ union_mknod(ap)
                int error;
                struct vnode *vp;
 
                int error;
                struct vnode *vp;
 

+               FIXUP(un);
+

                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);
                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);


@@ -421,9 +448,11 @@ union_open(ap)
                                        VOP_UNLOCK(tvp);
                                }
 
                                        VOP_UNLOCK(tvp);
                                }
 

+#ifdef UNION_DIAGNOSTIC

                                if (!error)
                                        uprintf("union: copied up %s\n",
                                                                un->un_path);
                                if (!error)
                                        uprintf("union: copied up %s\n",
                                                                un->un_path);

+#endif

                        }
 
                        un->un_flags &= ~UN_ULOCK;
                        }
 
                        un->un_flags &= ~UN_ULOCK;


@@ -462,6 +491,8 @@ union_open(ap)
                return (error);
        }
 
                return (error);
        }
 

+       FIXUP(un);
+

        error = VOP_OPEN(tvp, mode, cred, p);
 
        return (error);
        error = VOP_OPEN(tvp, mode, cred, p);
 
        return (error);


@@ -515,17 +546,26 @@ union_access(ap)
        int error = EACCES;
        struct vnode *vp;
 
        int error = EACCES;
        struct vnode *vp;
 

+       if (vp = un->un_uppervp) {
+               FIXUP(un);
+               return (VOP_ACCESS(vp, ap->a_mode, ap->a_cred, ap->a_p));
+       }
+

        if (vp = un->un_lowervp) {
                VOP_LOCK(vp);
                error = VOP_ACCESS(vp, ap->a_mode, ap->a_cred, ap->a_p);
        if (vp = un->un_lowervp) {
                VOP_LOCK(vp);
                error = VOP_ACCESS(vp, ap->a_mode, ap->a_cred, ap->a_p);

+               if (error == 0) {
+                       struct union_mount *um = MOUNTTOUNIONMOUNT(vp->v_mount);
+
+                       if (um->um_op == UNMNT_BELOW)
+                               error = VOP_ACCESS(vp, ap->a_mode,
+                                               um->um_cred, ap->a_p);
+               }

                VOP_UNLOCK(vp);
                if (error)
                        return (error);
        }
 
                VOP_UNLOCK(vp);
                if (error)
                        return (error);
        }
 

-       if (vp = un->un_uppervp)
-               error = VOP_ACCESS(vp, ap->a_mode, ap->a_cred, ap->a_p);
-

        return (error);
 }
 
        return (error);
 }
 


@@ -561,6 +601,7 @@ union_getattr(ap)
 
        vp = un->un_uppervp;
        if (vp != NULLVP) {
 
        vp = un->un_uppervp;
        if (vp != NULLVP) {

+               FIXUP(un);

                error = VOP_GETATTR(vp, vap, ap->a_cred, ap->a_p);
                if (error)
                        return (error);
                error = VOP_GETATTR(vp, vap, ap->a_cred, ap->a_p);
                if (error)
                        return (error);


@@ -631,6 +672,7 @@ union_setattr(ap)
         * otherwise return read-only filesystem error.
         */
        if (un->un_uppervp != NULLVP) {
         * otherwise return read-only filesystem error.
         */
        if (un->un_uppervp != NULLVP) {

+               FIXUP(un);

                error = VOP_SETATTR(un->un_uppervp, ap->a_vap,
                                        ap->a_cred, ap->a_p);
        } else {
                error = VOP_SETATTR(un->un_uppervp, ap->a_vap,
                                        ap->a_cred, ap->a_p);
        } else {


@@ -655,6 +697,8 @@ union_read(ap)
 
        if (dolock)
                VOP_LOCK(vp);
 
        if (dolock)
                VOP_LOCK(vp);

+       else
+               FIXUP(VTOUNION(ap->a_vp));

        error = VOP_READ(vp, ap->a_uio, ap->a_ioflag, ap->a_cred);
        if (dolock)
                VOP_UNLOCK(vp);
        error = VOP_READ(vp, ap->a_uio, ap->a_ioflag, ap->a_cred);
        if (dolock)
                VOP_UNLOCK(vp);


@@ -677,6 +721,8 @@ union_write(ap)
 
        if (dolock)
                VOP_LOCK(vp);
 
        if (dolock)
                VOP_LOCK(vp);

+       else
+               FIXUP(VTOUNION(ap->a_vp));

        error = VOP_WRITE(vp, ap->a_uio, ap->a_ioflag, ap->a_cred);
        if (dolock)
                VOP_UNLOCK(vp);
        error = VOP_WRITE(vp, ap->a_uio, ap->a_ioflag, ap->a_cred);
        if (dolock)
                VOP_UNLOCK(vp);


@@ -746,6 +792,8 @@ union_fsync(ap)
 
                if (dolock)
                        VOP_LOCK(targetvp);
 
                if (dolock)
                        VOP_LOCK(targetvp);

+               else
+                       FIXUP(VTOUNION(ap->a_vp));

                error = VOP_FSYNC(targetvp, ap->a_cred,
                                        ap->a_waitfor, ap->a_p);
                if (dolock)
                error = VOP_FSYNC(targetvp, ap->a_cred,
                                        ap->a_waitfor, ap->a_p);
                if (dolock)


@@ -784,9 +832,11 @@ union_remove(ap)
                struct vnode *dvp = dun->un_uppervp;
                struct vnode *vp = un->un_uppervp;
 
                struct vnode *dvp = dun->un_uppervp;
                struct vnode *vp = un->un_uppervp;
 

+               FIXUP(dun);

                VREF(dvp);
                dun->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);
                VREF(dvp);
                dun->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);

+               FIXUP(un);

                VREF(vp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_vp);
                VREF(vp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_vp);


@@ -826,9 +876,11 @@ union_link(ap)
                struct vnode *dvp = dun->un_uppervp;
                struct vnode *vp = un->un_uppervp;
 
                struct vnode *dvp = dun->un_uppervp;
                struct vnode *vp = un->un_uppervp;
 

+               FIXUP(dun);

                VREF(dvp);
                dun->un_flags |= UN_KLOCK;
                vput(ap->a_vp);
                VREF(dvp);
                dun->un_flags |= UN_KLOCK;
                vput(ap->a_vp);

+               FIXUP(un);

                VREF(vp);
                vrele(ap->a_tdvp);
 
                VREF(vp);
                vrele(ap->a_tdvp);
 


@@ -871,6 +923,7 @@ union_rename(ap)
                        goto bad;
                }
 
                        goto bad;
                }
 

+               FIXUP(un);

                fdvp = un->un_uppervp;
                VREF(fdvp);
                vrele(ap->a_fdvp);
                fdvp = un->un_uppervp;
                VREF(fdvp);
                vrele(ap->a_fdvp);


@@ -883,6 +936,7 @@ union_rename(ap)
                        goto bad;
                }
 
                        goto bad;
                }
 

+               FIXUP(un);

                fvp = un->un_uppervp;
                VREF(fvp);
                vrele(ap->a_fvp);
                fvp = un->un_uppervp;
                VREF(fvp);
                vrele(ap->a_fvp);


@@ -942,6 +996,7 @@ union_mkdir(ap)
                int error;
                struct vnode *vp;
 
                int error;
                struct vnode *vp;
 

+               FIXUP(un);

                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);
                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);


@@ -982,9 +1037,11 @@ union_rmdir(ap)
                struct vnode *dvp = dun->un_uppervp;
                struct vnode *vp = un->un_uppervp;
 
                struct vnode *dvp = dun->un_uppervp;
                struct vnode *vp = un->un_uppervp;
 

+               FIXUP(dun);

                VREF(dvp);
                dun->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);
                VREF(dvp);
                dun->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);

+               FIXUP(un);

                VREF(vp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_vp);
                VREF(vp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_vp);


@@ -1026,6 +1083,7 @@ union_symlink(ap)
                struct vnode *vp;
                struct mount *mp = ap->a_dvp->v_mount;
 
                struct vnode *vp;
                struct mount *mp = ap->a_dvp->v_mount;
 

+               FIXUP(un);

                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);
                VREF(dvp);
                un->un_flags |= UN_KLOCK;
                vput(ap->a_dvp);


@@ -1058,8 +1116,10 @@ union_readdir(ap)
        int error = 0;
        struct union_node *un = VTOUNION(ap->a_vp);
 
        int error = 0;
        struct union_node *un = VTOUNION(ap->a_vp);
 

-       if (un->un_uppervp)
+       if (un->un_uppervp) {
+               FIXUP(un);

                error = VOP_READDIR(un->un_uppervp, ap->a_uio, ap->a_cred);
                error = VOP_READDIR(un->un_uppervp, ap->a_uio, ap->a_cred);

+       }

 
        return (error);
 }
 
        return (error);
 }


@@ -1078,6 +1138,8 @@ union_readlink(ap)
 
        if (dolock)
                VOP_LOCK(vp);
 
        if (dolock)
                VOP_LOCK(vp);

+       else
+               FIXUP(VTOUNION(ap->a_vp));

        error = VOP_READLINK(vp, ap->a_uio, ap->a_cred);
        if (dolock)
                VOP_UNLOCK(vp);
        error = VOP_READLINK(vp, ap->a_uio, ap->a_cred);
        if (dolock)
                VOP_UNLOCK(vp);


@@ -1098,8 +1160,12 @@ union_abortop(ap)
        int islocked = un->un_flags & UN_LOCKED;
        int dolock = (vp == LOWERVP(ap->a_dvp));
 
        int islocked = un->un_flags & UN_LOCKED;
        int dolock = (vp == LOWERVP(ap->a_dvp));
 

-       if (islocked && dolock)
-               VOP_LOCK(vp);
+       if (islocked) {
+               if (dolock)
+                       VOP_LOCK(vp);
+               else
+                       FIXUP(VTOUNION(ap->a_dvp));
+       }

        error = VOP_ABORTOP(vp, ap->a_cnp);
        if (islocked && dolock)
                VOP_UNLOCK(vp);
        error = VOP_ABORTOP(vp, ap->a_cnp);
        if (islocked && dolock)
                VOP_UNLOCK(vp);


@@ -1246,6 +1312,8 @@ union_bmap(ap)
 
        if (dolock)
                VOP_LOCK(vp);
 
        if (dolock)
                VOP_LOCK(vp);

+       else
+               FIXUP(VTOUNION(ap->a_vp));

        error = VOP_BMAP(vp, ap->a_bn, ap->a_vpp, ap->a_bnp, ap->a_runp);
        if (dolock)
                VOP_UNLOCK(vp);
        error = VOP_BMAP(vp, ap->a_bn, ap->a_vpp, ap->a_bnp, ap->a_runp);
        if (dolock)
                VOP_UNLOCK(vp);


@@ -1290,6 +1358,8 @@ union_pathconf(ap)
 
        if (dolock)
                VOP_LOCK(vp);
 
        if (dolock)
                VOP_LOCK(vp);

+       else
+               FIXUP(VTOUNION(ap->a_vp));

        error = VOP_PATHCONF(vp, ap->a_name, ap->a_retval);
        if (dolock)
                VOP_UNLOCK(vp);
        error = VOP_PATHCONF(vp, ap->a_name, ap->a_retval);
        if (dolock)
                VOP_UNLOCK(vp);