Bug 275570 - self-referential nullfs mount over tmpfs in combination with MNT_UPDATE results in a hang
Summary: self-referential nullfs mount over tmpfs in combination with MNT_UPDATE resul...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 14.0-RELEASE
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-fs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-06 13:48 UTC by Alex S
Modified: 2026-05-23 07:14 UTC (History)
8 users (show)

See Also:

Attachments
deadlock.c (2.12 KB, text/plain)
2023-12-06 13:48 UTC, Alex S 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex S 2023-12-06 13:48:25 UTC 
Created attachment 246821 [details]
deadlock.c

Update the issue title as you see fit.

The attached repro works in 14 and CURRENT. I admit mounting a path on itself is a bit silly (and probably should be forbidden), but the hang is still worth a look.
Comment 1 Kyle Evans freebsd_committer freebsd_triage 2023-12-13 01:37:32 UTC 
Let's start with dfr@, since the sample in question is specifically null-mounting a file over itself.

With the deadlock.c attached, I hit it best with a stupid simple loop:

```
#!/bin/sh

iteration=1

while true; do
        echo "Iteration $iteration"
        ./a.out
        iteration=$((iteration + 1))
done
```

Took me about 15 tries. When it deadlocks on my machine, it's in the nmount(2) that would be null-mounting the file over itself rather than the follow-up MNT_UPDATE of the tmpfs mount holding it.
Comment 2 Kyle Evans freebsd_committer freebsd_triage 2023-12-13 01:49:37 UTC 
Oh, let's CC pho@ too, as this might have some good inspiration for his testing...
Comment 3 Mark Linimon freebsd_committer freebsd_triage 2026-05-15 22:55:42 UTC 
^Triage: is this still a problem on supported versions of FreeBSD?
Comment 4 Alex S 2026-05-16 04:14:39 UTC 
Yes, this is as relevant as ever.
Comment 5 Peter Holm freebsd_committer freebsd_triage 2026-05-16 14:35:20 UTC 
I was able to reproduce the problem with a GENERICish kernel:
https://people.freebsd.org/~pho/stress/log/log0663.txt
Comment 6 Konstantin Belousov freebsd_committer freebsd_triage 2026-05-16 22:18:43 UTC 
Ok, lets disable mounting a vnode over itself.
Comment 7 commit-hook freebsd_committer freebsd_triage 2026-05-17 19:45:00 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=7bdf2b5d5fbabfc8749c4ff6e618c3e843b14de0

commit 7bdf2b5d5fbabfc8749c4ff6e618c3e843b14de0
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-05-16 22:16:45 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-05-17 19:44:06 +0000

    nullfs: do not allow to mount a vnode over itself

    This causes recursion in VFS that is not worth handling.

    PR:     275570
    Reported by:    Alex S <iwtcex@gmail.com>
    Reviewed by:    markj
    Tested by:      pho
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D57043

 sys/fs/nullfs/null_vfsops.c | 8 ++++++++
 1 file changed, 8 insertions(+)
Comment 8 commit-hook freebsd_committer freebsd_triage 2026-05-23 07:14:10 UTC 
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=b393aa8e30b5911a5177b6aaacd5a62beea8e3d6

commit b393aa8e30b5911a5177b6aaacd5a62beea8e3d6
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-05-16 22:16:45 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-05-23 06:56:13 +0000

    nullfs: do not allow to mount a vnode over itself

    PR:     275570

    (cherry picked from commit 7bdf2b5d5fbabfc8749c4ff6e618c3e843b14de0)

 sys/fs/nullfs/null_vfsops.c | 8 ++++++++
 1 file changed, 8 insertions(+)