kern/43560: writing to null device in unionfs fails

[Taylor R Campbell <campbell+netbsd%mumble.net@localhost>]

>Number:         43560
>Category:       kern
>Synopsis:       writing to null device in unionfs fails
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 02 20:40:00 +0000 2010
>Originator:     Taylor R Campbell <campbell+netbsd%mumble.net@localhost>
>Release:        NetBSD 5.1_RC2
>Organization:
>Environment:
System: NetBSD ... 5.1_RC2 NetBSD 5.1_RC2 (RIAGATE) #0: Mon Jun 21 22:23:02 UTC 
2010  root@.../obj/sys/arch/i386/compile/RIAGATE i386
Architecture: i386
Machine: i386
>Description:

        If /foo/null is a null device (like /dev/null), and /bar is
        mounted with

                mount -t union -o -b /foo /bar

        then

                echo x > /bar/null

        fails with EROFS, and

                echo x >> /bar/null

        causes a panic.  This is reproducible.

        Kernel configuration:

include "arch/i386/conf/GENERIC"
options         FFS_EI          # FFS Endian Independent Support
options         APPLE_UFS       # Apple UFS support in FFS
options         GATEWAY         # packet forwarding
pseudo-device   pf                      # PF packet filter
pseudo-device   pflog                   # PF log if

>How-To-Repeat:

        # mkdir /foo
        # cp /dev/MAKEDEV /foo/
        # cd /foo
        # ./MAKEDEV all
        # mkdir /bar
        # mount -t union -o -b /foo /bar
        # echo foo > /bar/null
        -sh: cannot create /bar/null: read-only file system
        # echo foo >> /bar/null
        panic: union: missing upper layer in write

>Fix:

        Yes, please!