From c16c4ea6d399332d4a023df6e423be61fdb875a5 Mon Sep 17 00:00:00 2001
From: Mateusz Guzik <mjg@FreeBSD.org>
Date: Thu, 23 Mar 2023 19:19:48 +0000
Subject: [PATCH] vfs cache: return ENOTDIR for not_a_dir/{.,..} lookups

Reported by:	Oliver Kiddle
PR:	270419
MFC:	3 days
---
 sys/kern/vfs_cache.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sys/kern/vfs_cache.c b/sys/kern/vfs_cache.c
index 3ae2b663fffb..e716113e6085 100644
--- a/sys/kern/vfs_cache.c
+++ b/sys/kern/vfs_cache.c
@@ -5065,6 +5065,12 @@ cache_fplookup_dot(struct cache_fpl *fpl)
 	int error;
 
 	MPASS(!seqc_in_modify(fpl->dvp_seqc));
+
+	if (__predict_false(fpl->dvp->v_type != VDIR)) {
+		cache_fpl_smr_exit(fpl);
+		return (cache_fpl_handled_error(fpl, ENOTDIR));
+	}
+
 	/*
 	 * Just re-assign the value. seqc will be checked later for the first
 	 * non-dot path component in line and/or before deciding to return the
@@ -5127,6 +5133,11 @@ cache_fplookup_dotdot(struct cache_fpl *fpl)
 		return (cache_fpl_partial(fpl));
 	}
 
+	if (__predict_false(dvp->v_type != VDIR)) {
+		cache_fpl_smr_exit(fpl);
+		return (cache_fpl_handled_error(fpl, ENOTDIR));
+	}
+
 	ncp = atomic_load_consume_ptr(&dvp->v_cache_dd);
 	if (ncp == NULL) {
 		return (cache_fpl_aborted(fpl));