kern/54195: -current (20190508) null mounts: panic:kernel diagnostic assertion "fstrans_is_owner(mp)" failed: file "/src/NetBSD/cur/src/sys/kern/vfs_vnode.c", line 495

[kardel%netbsd.org@localhost]

>Number:         54195
>Category:       kern
>Synopsis:       unmount of stacked null mount may panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat May 11 13:10:00 +0000 2019
>Originator:     Frank Kardel
>Release:        NetBSD 8.99.39 20190510
>Organization:
	
>Environment:
System: NetBSD pip.kardel.name 8.99.39 NetBSD 8.99.39 (GENERIC) #0: Fri May 10 09:42:46 UTC 2019 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
	unmount of stacked null mounts may panic: kernel diagnostic assertion "fstrans_is_owner(mp)" failed: file "/src/NetBSD/cur/src/sys/kern/vfs_vnode.c", line 495
>How-To-Repeat:
	mkdir /p
	mkdir /p/d
	mkdir /pp
	mount -t null /p /pp
	mkdir /ppp
	mount -t null /pp /ppp
	mount -t null /pp/d /ppp/d
	umount /ppp/d
	=> panic

(gdb) bt
#0  0xffffffff80222caa in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /src/NetBSD/cur/src/sys/arch/amd64/amd64/machdep.c:728
#1  0xffffffff80a13386 in vpanic (fmt=0xffffffff813594a8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=ap@entry=0xffff82849760cc88)
    at /src/NetBSD/cur/src/sys/kern/subr_prf.c:335
#2  0xffffffff80e4f03b in kern_assert (fmt=fmt@entry=0xffffffff813594a8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ")
    at /src/NetBSD/cur/src/sys/lib/libkern/kern_assert.c:51
#3  0xffffffff80a77983 in vrele_flush (mp=<optimized out>) at /src/NetBSD/cur/src/sys/kern/vfs_vnode.c:495
#4  0xffffffff80a67023 in vflush (mp=mp@entry=0xffffe55b36b06008, skipvp=skipvp@entry=0xffffe55ab99d1038, flags=0) at /src/NetBSD/cur/src/sys/kern/vfs_mount.c:595
#5  0xffffffff808cef72 in nullfs_unmount (mp=0xffffe55b36b06008, mntflags=<optimized out>) at /src/NetBSD/cur/src/sys/miscfs/nullfs/null_vfsops.c:197
#6  0xffffffff80a6c07f in VFS_UNMOUNT (mp=mp@entry=0xffffe55b36b06008, a=a@entry=0) at /src/NetBSD/cur/src/sys/kern/vfs_subr.c:1340
#7  0xffffffff80a6936e in dounmount (mp=mp@entry=0xffffe55b36b06008, flags=0, l=l@entry=0xffffe55b3236e2a0) at /src/NetBSD/cur/src/sys/kern/vfs_mount.c:875
#8  0xffffffff80a6f80f in sys_unmount (l=0xffffe55b3236e2a0, uap=0xffff82849760d000, retval=<optimized out>) at /src/NetBSD/cur/src/sys/kern/vfs_syscalls.c:634
#9  0xffffffff80251092 in sy_call (rval=0xffff82849760cfb0, uap=0xffff82849760d000, l=0xffffe55b3236e2a0, sy=0xffffffff81857df0 <sysent+528>)
    at /src/NetBSD/cur/src/sys/sys/syscallvar.h:65
#10 sy_invoke (code=22, rval=0xffff82849760cfb0, uap=0xffff82849760d000, l=0xffffe55b3236e2a0, sy=0xffffffff81857df0 <sysent+528>)
    at /src/NetBSD/cur/src/sys/sys/syscallvar.h:94
#11 syscall (frame=0xffff82849760d000) at /src/NetBSD/cur/src/sys/arch/x86/x86/syscall.c:138
#12 0xffffffff802096dd in handle_syscall ()
#13 0x00007f7fff2b3d90 in ?? ()
#14 0x0000000000000000 in ?? ()
(gdb) print panicstr
$1 = 0xffffffff8198fe20 <scratchstr> "kernel diagnostic assertion \"fstrans_is_owner(mp)\" failed: file \"/src/NetBSD/cur/src/sys/kern/vfs_vnode.c\", line 495 "

	The initial "mount -t null /p /pp" is necessary, without it the panic does not happen.
>Fix:
	don't stack too many null mounts :-(.