Do not call the VOP_LOOKUP() for the doomed directory vnode. The

vnode could be reclaimed while lock upgrade was performed.

Sponsored by:	The FreeBSD Foundation
Reported and tested by:	pho
Diagnosed and reviewed by:	rmacklem
MFC after:	1 week

sys/kern/vfs_lookup.c

@@ -698,6 +698,10 @@ unionlookup:
 	    VOP_ISLOCKED(dp) == LK_SHARED &&
 	    (cnp->cn_flags & ISLASTCN) && (cnp->cn_flags & LOCKPARENT))
 		vn_lock(dp, LK_UPGRADE|LK_RETRY);
+	if ((dp->v_iflag & VI_DOOMED) != 0) {
+		error = ENOENT;
+		goto bad;
+	}
 	/*
 	 * If we're looking up the last component and we need an exclusive
 	 * lock, adjust our lkflags.