Re: kern/44288: tmpfs_rmdir() panic

[Taylor R Campbell <campbell%mumble.net@localhost>]

The following reply was made to PR kern/44288; it has been noted by GNATS.

From: Taylor R Campbell <campbell%mumble.net@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/44288: tmpfs_rmdir() panic
Date: Mon, 28 Feb 2011 16:35:50 +0000

 This transcript doesn't look right.  `rename' is a simple wrapper for
 the rename(2) system call, with none of the bells & whistles of mv(1).
 /tmp is mounted on tmpfs.
 
 % cd /tmp
 % mkdir test
 % cd test
 % mkdir foo bar
 % ls -lid * .
 28570683 drwxr-xr-x  4 riastradh  wheel  40 Feb 28 15:56 .
 28570657 drwxr-xr-x  2 riastradh  wheel   0 Feb 28 15:56 bar
 28570662 drwxr-xr-x  2 riastradh  wheel   0 Feb 28 15:56 foo
 % rename foo bar
 % ls -lid * .
 28570683 drwxr-xr-x  4 riastradh  wheel  20 Feb 28 15:56 .
 28570662 drwxr-xr-x  2 riastradh  wheel   0 Feb 28 15:56 bar
 
 Note that the link count on . doesn't change.  Looks like tmpfs_rename
 needs to decrement the link count of tdnode if it renames a directory
 over a directory, since tmpfs_dir_detach leaves the caller with the
 responsibility of adjusting the directory's link count (see, e.g.,
 tmpfs_rmdir).  I'll try this in a bit with rump.  (For now, uh, I'll
 try to make sure nobody rmdirs /tmp/test on my laptop...oops.)
 
 --- tmpfs_vnops.c      2011-01-29 14:52:38.000000000 +0000
 +++ tmpfs_vnops.c      2011-02-28 16:34:52.000000000 +0000
 @@ -982,6 +982,12 @@
                KASSERT(de2->td_node == tnode);
                tmpfs_dir_detach(tdvp, de2);
  
 +              /* If we just detached a directory, decrement the
 +               * parent's link count, since the to-node's .. will no
 +               * longer point to it.  */
 +              if (tnode->tn_type == VDIR)
 +                      tdnode->tn_links--;
 +
                /* Free the directory entry we just deleted.  Note that the
                 * node referred by it will not be removed until the vnode is
                 * really reclaimed. */