nullfs can mount a single regular file, producing a mount whose root
vnode is VREG with VV_ROOT set and whose covered vnode is VREG. Two
paths still assumed such a mount point is a directory.
vfs_domount_first() ran vn_dir_check_empty() for any mount carrying the
generic "emptydir" option, a VREG file mount included, tripping the
VNPASS(vp->v_type == VDIR) assertion in vn_dir_check_empty() (and,
without INVARIANTS, issuing VOP_READDIR on a regular file). Perform the
empty-directory check only for directories and reject "emptydir" on a
file mount with ENOTDIR. This is user triggerable via
mount_nullfs -o emptydir over a regular file.
vn_fullpath_any() tested v_type != VDIR before VV_ROOT, so a file mount
root was handed to vn_vptocnp()/VOP_VPTOCNP, which nullfs forwards to
the lower vnode and which then resolves the source file's path instead
of the mount path. Climb to the covered vnode first, mirroring the
VV_ROOT handling already in vn_fullpath_dir() and vn_fullpath_any_smr(),
including the doomed-vnode, NULL mnt_vnodecovered, and v_mountedhere
consistency checks, so the slow path agrees with the SMR fast path.
This corrects the path reported by fstat(1), procstat(1), procfs,
linprocfs, and audit for a file-mount fd whenever the fast path is
unavailable, e.g. with vfs.cache.param.fast_lookup=0 or a namecache
miss on the covered file's parent.
Signed-off-by: Nick Price <nick@spun.io>