nfs_lookup/nfs_mkdir error paths vrele() vnodes that nfs_nget returned LK_EXCLUSIVE-locked — permanent vnode-lock leak, mount wedge / vnode exhaustion DoS from malformed server replies

Summary

nfs_nget returns vnodes locked LK_EXCLUSIVE (nfs_node.c:129 vget, :216 vx_downgrade). nfs_lookup's error exit and the ERROROUT post-op-attr paths reached with a successfully nget'd newvp, plus nfs_mkdir's 'EEXIST || !gotvp' vrele and its error tail, drop those vnodes with vrele() instead of vput() — the exclusive lock is never released, so the vnode can never be locked or recycled again. nfs_nresolve (the new-API equivalent) does it correctly with vput(), proving the inconsistency. Trigger: a malicious server that returns a valid file handle in a LOOKUP/MKDIR reply followed by malformed post-op attributes (nfsm_dissect NULL → EBADRPC) — each occurrence permanently wedges one vnode; repetition exhausts the vnode pool and stalls all operations touching the affected vnodes (including unkillable processes on the mount). Unpriv local user on a client whose NFS server is malicious/compromised (or an active spoofer). Not verified this run (budget spent on DF-2996); code-reading certain. Fix: vput() on nfs_nget-sourced vnodes (vrele remains correct for the dvp-echo vref'd case).

Timeline

• 2026-09-02 Discovered during pass-2 audit of nfs_vnops.c (GLM 5.3).