I can reliably deadlock a 9.3-STABLE by the following procedure: Let's assume that /tmp is a standard swap-backed file system already. First let's set up what we need: mkdir /tmp/1 /tmp/2 mount -v -t unionfs /tmp/1 /usr/local mount -v -t unionfs /tmp/2 /usr/local No let's lock the system: mkdir /tmp/2/bla while :; do echo go tar -cC /usr/src/etc -f - . | tar -xpC /tmp/2/bla -f - done It survives about 3 or 4 rounds, sometimes more, sometimes only 2. It is important to use tar to copy the stuff. If we replace the tar line by e.g. cp -pR /usr/src/etc/* /tmp/2/bla things are all well. The system doesn't lock up entirely, you can move the mouse and ping it but no fs access is possible anymore. One can switch to the console and enter the debugger but a reboot with ctrl-alt-del doesn't work... The interesting part is that all this worked pretty well on 9-STABLE until approx. 2 months ago. But nothing had been committed to unionfs for a long time so I really have no idea what's going on. It also reminds us of https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=161511 but this stuff had been merged to 9-STABLE already...
I tried reproduction steps on 11.2 and 12.0, and there are no deadlocks. Can we close this?
Just tested, it doesn't lock up here either on 11.3. However, my actual use case was more complex -- for the PR I just stripped it down as far as I could. For the time being I adopted it so only one union mount was used (which worked). Let me revert to the old mode and give me some time to check (it will take a bit...)
I have to revise my statement... I ran the test below for about 10-20 seconds and was happy to see that it doesn't hang the box anymore. Then I wrote the last comment (#2). After that I continued with my regular work (some vi, ssh, firefox, ...). I did NOT unmount the two unionfs on /tmp so they remained in the state they had after aborting the test. Approx 2.5 hours later the machine suddenly hung with exactly the same symptoms as described (mouse OK, KBD OK, no fs, no Ctrl-Alt-Del, had to go to the console and restart using the debugger). I did not touch the two mount points /tmp/1 and /tmp/2 but I used /usr/local (read-only) of course and a lot of rw on /tmp.