nfs_nget() does no locking whatsoever when looking up a vnode. If the

vget() sleeps we have to retry the operation to avoid racing against
a deletion.

MFC maybe: submitted to re's

sys/nfsclient/nfs_node.c

@@ -194,7 +194,10 @@ nfs_nget(struct mount *mntp, nfsfh_t *fhp, int fhsize, struct nfsnode **npp)
 		    bcmp((caddr_t)fhp, (caddr_t)np->n_fhp, fhsize))
 			continue;
 		vp = NFSTOV(np);
-		if (vget(vp, LK_EXCLUSIVE, td))
+		/*
+		 * np or vp may become invalid if vget() blocks, so loop 
+		 */
+		if (vget(vp, LK_EXCLUSIVE|LK_SLEEPFAIL, td))
 			goto loop;
 		*npp = np;
 		return(0);