 @@ -1,14 +1,14 @@
-/*	$NetBSD: vfs_cache.c,v 1.139 2020/04/13 19:23:18 ad Exp $	*/
+/*	$NetBSD: vfs_cache.c,v 1.140 2020/04/22 21:35:52 ad Exp $	*/
 /*-
  * Copyright (c) 2008, 2019, 2020 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Andrew Doran.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -162,27 +162,27 @@
+ *
  *	1) vi->vi_nc_lock	(tree or parent -> child direction,
  *				 used during forward lookup)
+ *
  *	2) vi->vi_nc_listlock	(list or child -> parent direction,
  *				 used during reverse lookup)
+ *
  *	3) cache_lru_lock	(LRU list direction, used during reclaim)
+ *
  *	4) vp->v_interlock	(what the cache entry points to)
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vfs_cache.c,v 1.139 2020/04/13 19:23:18 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_cache.c,v 1.140 2020/04/22 21:35:52 ad Exp $");
 #define __NAMECACHE_PRIVATE
 #ifdef _KERNEL_OPT
 #include "opt_ddb.h"
 #include "opt_dtrace.h"
 #endif
 #include <sys/types.h>
 #include <sys/atomic.h>
 #include <sys/callout.h>
 #include <sys/cpu.h>
 #include <sys/errno.h>
 #include <sys/evcnt.h>
 @@ -654,30 +654,37 @@ cache_lookup_linked(struct vnode *dvp, c
 	 * Acquire the directory lock.  Once we have that, we can drop the
 	 * previous one (if any).
+	 *
 	 * The two lock holds mean that the directory can't go away while
 	 * here: the directory must be purged with cache_purge() before
 	 * being freed, and both parent & child's vi_nc_lock must be taken
 	 * before that point is passed.
+	 *
 	 * However if there's no previous lock, like at the root of the
 	 * chain, then "dvp" must be referenced to prevent dvp going away
 	 * before we get its lock.
+	 *
 	 * Note that the two locks can be the same if looking up a dot, for
-	 * example: /usr/bin/.
+	 * example: /usr/bin/.  If looking up the parent (..) we can't wait
 	 * on the lock as child -> parent is the wrong direction.
 	 */
 	if (*plock != &dvi->vi_nc_lock) {
-		rw_enter(&dvi->vi_nc_lock, RW_READER);
+		if (namelen == 2 && name[0] == '.' && name[1] == '.') {
 			if (!rw_tryenter(&dvi->vi_nc_lock, RW_READER)) {
 				return false;
+			}
 		} else {
 			rw_enter(&dvi->vi_nc_lock, RW_READER);
+		}
 		if (*plock != NULL) {
 			rw_exit(*plock);
+		}
 		*plock = &dvi->vi_nc_lock;
 	} else if (*plock == NULL) {
 		KASSERT(vrefcnt(dvp) > 0);
+	}
 	/*
 	 * First up check if the user is allowed to look up files in this
 	 * directory.
 	 */
 	KASSERT(dvi->vi_nc_mode != VNOVAL && dvi->vi_nc_uid != VNOVAL &&

 @@ -1,14 +1,14 @@
-/*	$NetBSD: vfs_lookup.c,v 1.218 2020/04/21 21:42:47 ad Exp $	*/
+/*	$NetBSD: vfs_lookup.c,v 1.219 2020/04/22 21:35:52 ad Exp $	*/
 /*
  * Copyright (c) 1982, 1986, 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
  * (c) UNIX System Laboratories, Inc.
  * All or some portions of this file are derived from material licensed
  * to the University of California by American Telephone and Telegraph
  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
  * the permission of UNIX System Laboratories, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -27,27 +27,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  *	@(#)vfs_lookup.c	8.10 (Berkeley) 5/27/95
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vfs_lookup.c,v 1.218 2020/04/21 21:42:47 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_lookup.c,v 1.219 2020/04/22 21:35:52 ad Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_magiclinks.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/syslimits.h>
 #include <sys/time.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
 #include <sys/vnode_impl.h>
 @@ -1276,72 +1276,79 @@ lookup_fastforward(struct namei_state *s
 		/*
 		 * Get the next component name.  There should be no slashes
 		 * here, and we shouldn't have looped around if we were
 		 * done.
 		 */
 		KASSERT(cnp->cn_nameptr[0] != '/');
 		KASSERT(cnp->cn_nameptr[0] != '\0');
 		if ((error = lookup_parsepath(state)) != 0) {
 			break;
+		}
 		/*
-		 * Can't deal with dotdot lookups, because it means lock
+		 * Can't deal with DOTDOT lookups if NOCROSSMOUNT or the
-		 * order reversal, and there are checks in lookup_once()
+		 * lookup is chrooted.
 		 * that need to be made.  Also check for missing mountpoints.
 		 */
-		if ((cnp->cn_flags & ISDOTDOT) != 0 ||
+		if ((cnp->cn_flags & ISDOTDOT) != 0) {
-		    searchdir->v_mount == NULL) {
+			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
-			error = EOPNOTSUPP;
+			    (cnp->cn_flags & NOCROSSMOUNT)) {
-			break;
+			    	error = EOPNOTSUPP;
 				break;
+			}
 			if (ndp->ni_rootdir != rootvnode) {
 			    	error = EOPNOTSUPP;
 				break;
+			}
+		}
 		/*
 		 * Can't deal with last component when modifying; this needs
 		 * searchdir locked and VOP_LOOKUP() called (which can and
 		 * does modify state, despite the name).
 		 */
 		if ((cnp->cn_flags & ISLASTCN) != 0) {
 			if (cnp->cn_nameiop != LOOKUP ||
 			    (cnp->cn_flags & LOCKPARENT) != 0) {
 				error = EOPNOTSUPP;
 				break;
+			}
+		}
 		/* Can't deal with -o union lookups. */
 		if ((searchdir->v_vflag & VV_ROOT) != 0 &&
 		    (searchdir->v_mount->mnt_flag & MNT_UNION) != 0) {
 		    	error = EOPNOTSUPP;
 		    	break;
 		/*
 		 * Good, now look for it in cache.  cache_lookup_linked()
 		 * will fail if there's nothing there, or if there's no
 		 * ownership info for the directory, or if the user doesn't
 		 * have permission to look up files in this directory.
 		 */
 		if (!cache_lookup_linked(searchdir, cnp->cn_nameptr,
 		    cnp->cn_namelen, &foundobj, &plock, cnp->cn_cred)) {
 			error = EOPNOTSUPP;
 			break;
+		}
 		KASSERT(plock != NULL && rw_lock_held(plock));
-		/* Scored a hit.  Negative is good too (ENOENT). */
+		/*
 		 * Scored a hit.  Negative is good too (ENOENT).  If there's
 		 * a '-o union' mount here, punt and let lookup_once() deal
 		 * with it.
 		 */
 		if (foundobj == NULL) {
-			error = ENOENT;
+			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
 			    (searchdir->v_mount->mnt_flag & MNT_UNION) != 0) {
 			    	error = EOPNOTSUPP;
 			} else {
 				error = ENOENT;
+			}
 			break;
+		}
 		/*
 		 * Stop and get a hold on the vnode if there's something
 		 * that can't be handled here:
+		 *
 		 * - we've reached the last component.
 		 * - or encountered a mount point that needs to be crossed.
 		 * - or encountered something other than a directory.
 		 */
 		if ((cnp->cn_flags & ISLASTCN) != 0 ||
 		    foundobj->v_type != VDIR ||