Panic in tmpfs

[Michael Plass <mfpnb%plass-family.net@localhost>]

I ran into this panic yesterday:

panic: kernel diagnostic assertion "node->tn_links == 0" failed: file "/home/michael/NetBSD-7.0/build/usr/src/sys/fs/tmpfs/tmpfs_subr.c", line 261
db{3}> bt
0xb384dcec: netbsd:vpanic+0xc
0xb384dd04: netbsd:__udivmoddi4
0xb384dd3c: netbsd:tmpfs_free_node+0x1ac
0xb384dd94: netbsd:tmpfs_construct_node+0x22c
0xb384ddbc: netbsd:tmpfs_mkdir+0x48
0xb384ddfc: netbsd:VOP_MKDIR+0x4c
0xb384df0c: netbsd:do_sys_mkdirat.constprop.4+0x120
0xb384df7c: netbsd:syscall+0x88
0xb384dfac: netbsd:swi_handler+0x98
db{3}> ps

It turns out to be easy to reproduce - just fill the tmpfs file system
and then try to create directories until it breaks.

This is on a NetBSD-7.0 RPI2 system patched
with http://www.netbsd.org/~skrll/usb.softint.diff:

NetBSD mipi 7.0 NetBSD 7.0 (RPI2_NET) #0: Sat Feb  6 23:07:24 PST 2016  michael%home.plass-family.net@localhost:/home/michael/NetBSD-7.0/build/usr/src/sys/arch/evbarm/compile/obj/RPI2_NET evbarm

I have this in my /etc/fstab:
tmpfs		/tmp		tmpfs	rw,-sram/2

mipi$ cd /tmp
mipi$ dd if=/dev/zero of=junk
dd: junk: No space left on device
966641+0 records in
966640+0 records out
494919680 bytes transferred in 32.255 secs (15343967 bytes/sec)
mipi$ jot 1000000 | while read i && mkdir -p $i; do printf '%s ' $i >&2; done
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 
(panics here)

Interestingly, an attempt to reproduce it using /var/shm, which is mounted with -sram%10,
did not end in panic.

Does this ring a bell with anybody? The only similar panic on gnats that I was able to
find was closed in 2011. But I've had trouble finding things in gnats before.


Thanks.
- Michael