This was a rather dumb miss on my part in commit 42442d7a6e.
LK_CANRECURSE is clearly needed in any case in which the covered vnode
is held exclusive across the call to VFS_ROOT(), regardless of whether
it was initially held exclusive or upgraded. The commit message for
that change also noted that unionfs lookup only worked without
LK_CANRECURSE due to a coincidence of the then-current unionfs
implementation. As it happens, said coincidence was recently removed
in commit b952606b4f ("unionfs_lock(): eliminate LK_CANRECURSE special-
case").
PR: 298201
Reported by: olivier
Fixes: 42442d7a6e "Generalize the VV_CROSSLOCK logic in
vfs_lookup"
stress2: add two new unionfs test scenarios
These exercise lookup traversal from tmpfs into unionfs, which is
useful because, unlike UFS, tmpfs does not allow recursion on its vnode
locks by default.
unionfs22.sh exercises these lookups with a normal unionfs mount, while
unionfs23.sh uses '-o below' for the unionfs mount and reproduces the
panic described in PR 298201.