Page MenuHomeFreeBSD
Files F163918391

filemount_panic.sh
Public
Actions

Authored By
nick_spun.io
Jul 27 2026, 4:30 AM
Size
1 KB
Referenced Files
None
Subscribers
None

filemount_panic.sh
View Options

#!/bin/sh
#
# Isolated reproducer for the panic in PR 282596, fixed by D58178.
# Run as root on an INVARIANTS kernel. It panics the machine:
#
# panic: condition vp->v_type == VDIR || VN_IS_DOOMED(vp) not met
# at ../../../kern/vfs_cache.c:NNNN (vn_fullpath_dir)
# vn_fullpath_dir()
# vn_fullpath_hardlink()
# proc_get_binpath()
# sysctl_kern_proc_pathname()
#
# nullfs can mount a single regular file. The resulting mount root is a VREG
# vnode with VV_ROOT set, so namei() has no directory to hand back as ni_dvp
# and returns the covered vnode, which for a file mount is itself a regular
# file. execve(2) stores that as p_textdvp, and any later kern.proc.pathname
# query on the process restarts the path walk from it:
#
# vn_fullpath_hardlink(vp = mount root, dvp = covered file, "cover")
# -> vn_fullpath_dir(covered file)
# -> VNPASS(vp->v_type == VDIR || VN_IS_DOOMED(vp), vp)
#
# vn_fullpath_hardlink() only reaches vn_fullpath_dir() once the lock-free
# namecache reverse walk it tries first has failed, so the cover file must not
# be in the namecache. The rename(2) below evicts it: cache_vop_rename()
# purges the renamed directory, dropping the entries that name its children.
# In the wild (www/foreign-cdm execs its Widevine worker from a single-file
# nullfs mount, then htop or procstat -b is run against it) the entry is
# evicted on its own under namecache pressure.
set -e
kldload -n nullfs
dir=$(mktemp -d)
: >"$dir/cover" # file to mount over, one hardlink
mount_nullfs /bin/sleep "$dir/cover" # single-file nullfs mount
"$dir/cover" 300 & # execve() -> p_textdvp = covered file
sleep 1 # let the exec finish
mv "$dir" "$dir.renamed" # evict the cover file's cache entry
procstat -b $! # kern.proc.pathname -> panic

File Metadata

Mime Type
text/x-shellscript
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35632530
Default Alt Text
filemount_panic.sh (1 KB)

Event Timeline

nick_spun.io changed the visibility from "nick_spun.io (Nick Price)" to "Public (No Login Required)".Mon, Jul 27, 2:19 PM