3 files changed, 20 insertions, 1 deletions

diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c
index 36f1165ca2e94..1835c9ce9480a 100644
--- a/sys/compat/linux/linux_misc.c
+++ b/sys/compat/linux/linux_misc.c
@@ -54,6 +54,7 @@
 #include <vm/vm_kern.h>
 #include <vm/vm_map.h>
 #include <vm/vm_extern.h>
+#include <vm/vm_zone.h>
 
 #include <machine/frame.h>
 #include <machine/psl.h>
@@ -194,10 +195,15 @@ linux_uselib(struct proc *p, struct linux_uselib_args *args)
 	goto cleanup;
 
     vp = ni.ni_vp;
+    /*
+     * XXX This looks like a bogus check - a LOCKLEAF namei should not succeed
+     * without returning a vnode.
+     */
     if (vp == NULL) {
 	error = ENOEXEC;	/* ?? */
 	goto cleanup;
     }
+    NDFREE(&ni, NDF_ONLY_PNBUF);
 
     /*
      * From here on down, we have a locked vnode that must be unlocked.
diff --git a/sys/compat/linux/linux_stats.c b/sys/compat/linux/linux_stats.c
index 14c8090303ff6..be40f152b9c47 100644
--- a/sys/compat/linux/linux_stats.c
+++ b/sys/compat/linux/linux_stats.c
@@ -44,6 +44,8 @@
 #include <i386/linux/linux_proto.h>
 #include <i386/linux/linux_util.h>
 
+#include <vm/vm_zone.h>
+
 struct linux_newstat {
 	u_short	stat_dev;
 	u_short	__pad1;
@@ -118,6 +120,7 @@ linux_newstat(struct proc *p, struct linux_newstat_args *args)
 	error = namei(&nd);
 	if (error)
 		return (error);
+	NDFREE(&nd, NDF_ONLY_PNBUF);
 
 	error = vn_stat(nd.ni_vp, &buf, p);
 	vput(nd.ni_vp);
@@ -154,6 +157,7 @@ linux_newlstat(p, uap)
 	error = namei(&nd);
 	if (error)
 		return (error);
+	NDFREE(&nd, NDF_ONLY_PNBUF); 
 
 	vp = nd.ni_vp;
 	error = vn_stat(vp, &sb, p);
@@ -224,6 +228,7 @@ linux_statfs(struct proc *p, struct linux_statfs_args *args)
 	error = namei(ndp);
 	if (error)
 		return error;
+	NDFREE(ndp, NDF_ONLY_PNBUF);
 	mp = ndp->ni_vp->v_mount;
 	bsd_statfs = &mp->mnt_stat;
 	vrele(ndp->ni_vp);
diff --git a/sys/compat/linux/linux_util.c b/sys/compat/linux/linux_util.c
index 7c87174089a91..0864ae7caac86 100644
--- a/sys/compat/linux/linux_util.c
+++ b/sys/compat/linux/linux_util.c
@@ -39,6 +39,8 @@
 
 #include <i386/linux/linux_util.h>
 
+#include <vm/vm_zone.h>
+
 const char      linux_emul_path[] = "/compat/linux";
 
 /*
@@ -135,6 +137,7 @@ linux_emul_find(p, sgp, prefix, path, pbuf, cflag)
 		if ((error = namei(&ndroot)) != 0) {
 			/* Cannot happen! */
 			free(buf, M_TEMP);
+			NDFREE(&nd, NDF_ONLY_PNBUF);
 			vrele(nd.ni_vp);
 			return error;
 		}
@@ -164,13 +167,18 @@ linux_emul_find(p, sgp, prefix, path, pbuf, cflag)
 		free(buf, M_TEMP);
 	}
 
+	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vrele(nd.ni_vp);
-	if (!cflag)
+	if (!cflag) {
+		NDFREE(&ndroot, NDF_ONLY_PNBUF);
 		vrele(ndroot.ni_vp);
+	}
 	return error;
 
 bad:
+	NDFREE(&ndroot, NDF_ONLY_PNBUF);
 	vrele(ndroot.ni_vp);
+	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vrele(nd.ni_vp);
 	free(buf, M_TEMP);
 	return error;