kern/52728: "mount -u /dev/ /" triggers kernel panic

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

>Number:         52728
>Category:       kern
>Synopsis:       "mount -u /dev/ /" triggers kernel panic
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 15 13:50:00 +0000 2017
>Originator:     Izumi Tsutsui
>Release:        NetBSD 8.0_BETA
>Organization:
>Environment:
System: NetBSD 8.0_BETA (GENERIC.201711070830Z), also happens on atari
Architecture: i386
Machine: i386
>Description:
"mount -u /dev/ /" command (which happens on NetBSD/atari dot.profile
script in sysinst.fs, which is missing sysctl(8) command to determine
root partition) triggers kernel panic, at least on single user.

This is also reproducible on NetBSD/i386 8.0_BETA.

>How-To-Repeat:

- boot NetBSD/i386 (or maybe any port) to single user
- type "mount -u /dev/ /" on root shell

--- panic messages typed from i386 screen ---

# uname -a
NetBSD  8.0_BETA NetBSD 8.0_BETA (GENERIC.201711070830Z) i386
# mount -u /dev/ /
mount_ffs: "/dev/" is a non-resolved or relative path.
mount_ffs: using "/dev" instead.
uvm_fault(0xc2ee3c6c, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip 0xc086a503 cs 0x8 eflags 0x10212 cr2 0xc ilevel 0 esp 0xbfb1ef9c
curlwp 0xc2f08020 pid 11 lid 1 lowest kstack 0xdb4ec2c0
kernel: supervisor trap page fault, code=0
Stopped in pid 11.1 (mount_ffs) at     netbsd:ffs_mount+0xa1:  movl    c(%edx),%ecx
db{0}> bt
ffs_mount(c2f03008,bfb1eb9c,c2a0a198,db4eef30,c2f03008,db4eef0c,c0991343,c2f0300
8,bfb1eb9c,c2a0a198) at netbsd:ffs_mount+0xa1
VFS_MOUNT(c2f03008,bfb1eb9c,c2a0a198,db4eef30,10000,c2a0a198,1,c124df60,5001,c12
4df00) at netbsd:VFS_MOUNT+0x34
do_sys_mount(c2f08020,dbffa4,0,bfb1eb9c,10000,bfb1eb94,0,4,db4eef60,db4eef9c) at
 netbsd:do_sys_mount+0x51a
sys___mount50(c2f08020,db4eef68,db4eef60,c2ee3c6c,ad3f1000,db4eef60,db4eef68,19a
,0,0) at netbsd:sys___mount50_0x4d
syscall() at netbsd:syscall+0x1ed
--- syscall (number 410) ---
ad3a1687:
db{0}> 

--- end of quote ---

>Fix:
N/A