kern/47255: openat kernel panic on tmpfs

[prlw1%cam.ac.uk@localhost]

>Number:         47255
>Category:       kern
>Synopsis:       openat() of file/directory on tmpfs triggers diagnostic 
>assertion
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 27 14:30:00 +0000 2012
>Originator:     Patrick Welche
>Release:        NetBSD 6.99.15
>Organization:
        
>Environment:
-current/amd64 of 26 Nov 2012 15:56 GMT
>Description:
The program below run as a normal user causes a diagnostic assertion to fail:

(hand copied:)
panic: kernel diagnostic assertion "VOP_ISLOCKED(vp" failed: file 
"../../../../fs/tmpfs/tmpfs_vnops.c", line 402
cpu3: Begin traceback...
kern_assert()
tmpfs_access() +0x15f
VOP_ACCESS() +0x33
do_sys_openat() +0xbe
sys_openat() +0x22
syscall number 468  +0x94

trap type 1 code 0 rip ffff ffffff 8019 1ccd cs 8 rflags 246 cr2 7f7f f796 3330 
ilevel 8 rsp ffff fe80 01ae 1a60


sync fails to give a core dump (panic during attempt)


>How-To-Repeat:
==================== Makefile ====================
PROG=openat_test
CPPFLAGS+=-D_INCOMPLETE_XOPEN_C063
MKMAN=no
.include <bsd.prog.mk>
================== openat_test.c =================
#include <err.h>
#include <fcntl.h>
#include <unistd.h>

int main()
{
        int fd, dfd;

        if (mkdir("/tmp/openfoo", 0755) != 0)
                err(1, NULL);

        dfd = open("/tmp/openfoo", O_RDONLY, 0);
        if (dfd == -1)
                err(1, NULL);

        fd = openat(dfd, "/tmp/openfoo/bar", O_RDONLY, 0);
        if (fd == -1)
                err(1, NULL);

        if (close(dfd) != 0)
                err(1, NULL);

        if (close(fd) != 0)
                err(1, NULL);

        return 0;
}
==================================================
>Fix: