kern/50381: Exhausting tmpfs filesystem: kernel diagnostic assertion "de->td_node == NULL" failed

[Leonardo Taccari <iamleot%gmail.com@localhost>]

>Number:         50381
>Category:       kern
>Synopsis:       Exhausting tmpfs filesystem: kernel diagnostic assertion "de->td_node == NULL" failed
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 29 15:05:00 +0000 2015
>Originator:     Leonardo Taccari
>Release:        NetBSD 7.99.21
>Organization:
Università Politecnica delle Marche
>Environment:
	
	
System: NetBSD boh 7.99.21 NetBSD 7.99.21 (GENERIC) #51: Mon Oct 26 03:30:36 CET 2015 leot@boh:/usr/obj/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
Exhausting a tmpfs filesystem can lead to kernel diagnostic assertion
"de->td_node == NULL" failed.
>How-To-Repeat:
Given a small enough tmpfs filesystem (256MB):

$ grep "\/tmp" /etc/fstab
tmpfs           /tmp            tmpfs   rw,-m=1777,-s=268886016

...and a big enough tarball (that will fit in the tmpfs but will not fit
it when extracted):

$ cd /tmp
$ ftp 'http://download.documentfoundation.org/libreoffice/src/5.0.3/libreoffice-dictionaries-5.0.3.1.tar.xz'
$ tar xJf libreoffice-dictionaries-5.0.3.1.tar.xz

...will crash the system.

The respective crash(8) output:

$ crash -N netbsd.14 -M netbsd.14.core
Crash version 7.99.21, image version 7.99.21.
System panicked: kernel diagnostic assertion "de->td_node == NULL"
failed: file "/usr/src/sys/fs/tmpfs/tmpfs_subr.c", line 473
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_NARCNET() at 0
vpanic() at vpanic+0x141
kern_assert() at kern_assert+0x4f
tmpfs_free_dirent() at tmpfs_free_dirent+0x65
tmpfs_construct_node() at tmpfs_construct_node+0x2aa
VOP_MKDIR() at VOP_MKDIR+0x40
do_sys_mkdirat.constprop.4() at do_sys_mkdirat.constprop.4+0x193
syscall() at syscall+0xbe
--- syscall (number 136) ---
7f7ff70a759a:

If the filesystem is big enough I could not reproduce this problem.

The above problem can be reproduced (less intrusively) also via
rump_tmpfs(8):

# rump_tmpfs -m 1777 -s 256M tmpfs /home/leot/tmp/tmpfs
[...]
$ cp libreoffice-dictionaries-5.0.3.1.tar.xz ~leot/tmp/tmpfs
$ cd ~leot/tmp/tmpfs
$ tar xJf libreoffice-dictionaries-5.0.3.1.tar.xz 
$ tar xJf libreoffice-dictionaries-5.0.3.1.tar.xz
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/sk_SK/sk_SK.dic (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/sk_SK/release_en.txt (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/sk_SK/sk_SK.aff (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/sk_SK/release_sk.txt (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/ro/hyph_ro_RO.dic (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/ro/META-INF/manifest.xml (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/ro/description.xml (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/ro/COPYING.LGPL (No space left on device)
tar: Failed write to file libreoffice-5.0.3.1/dictionaries/ro/README_RO.txt (No space left on device)
tar: Cannot create libreoffice-5.0.3.1/dictionaries/ro/th_ro_RO_v2.dat.PgGSYE (Device not configured)

...and at the same time where I have invoked rump_tmpfs(8):

panic: kernel diagnostic assertion "de->td_node == NULL" failed: file "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c", line 473
rump kernel halting...
halted

(Possible) relevant lines of "bt full" output of the rump_tmpfs.core:

[...]
#4  0x00007f7ff68645e5 in vpanic (fmt=0x7f7ff7810310 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=0x7f7fffffcc28)
    at /usr/src/lib/librump/../../sys/rump/../kern/subr_prf.c:342
        ci = <optimized out>
        oci = <optimized out>
        bootopt = 4
        scratchstr = "kernel diagnostic assertion \"de->td_node == NULL\" failed: file \"/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c\", line 473 ", '\000' <repeats 112 times>
#5  0x00007f7ff684e1f2 in kern_assert (fmt=<optimized out>) at /usr/src/lib/librump/../../sys/rump/../lib/libkern/kern_assert.c:51
---Type <return> to continue, or q <return> to quit---
        ap = {{gp_offset = 40, fp_offset = 32639, overflow_arg_area = 0x7f7fffffcc80, reg_save_area = 0x7f7fffffcc40}}
#6  0x00007f7ff780d95e in tmpfs_free_dirent (tmp=0x7f7ff6f4e038, de=0x7f7fdfe416f0)
    at /usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c:473
No locals.
#7  0x00007f7ff780f161 in tmpfs_construct_node (dvp=0x7f7fdf398718, vpp=0x7f7fffffcd78, vap=0x7f7fdf1d04a8, cnp=<optimized out>,
    target=<optimized out>) at /usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c:406
        tmp = 0x7f7ff6f4e038
        dnode = 0x7f7fdf4b5680
        node = 0x1c
        de = 0x7f7fdfe416f0
        wde = <optimized out>
        slink = <optimized out>
        ssize = <optimized out>
        error = 28
#8  0x00007f7ff6857a5e in VOP_CREATE (dvp=0x7f7fdf398718, vpp=0x7f7fffffcd78, cnp=<optimized out>, vap=<optimized out>)
    at /usr/src/lib/librump/../../sys/rump/../kern/vnode_if.c:158
        error = <optimized out>
        mpsafe = <optimized out>
        a = {a_desc = 0x7f7ff6ad65c0 <rumpns_vop_create_desc>, a_dvp = 0x7f7fdf398718, a_vpp = 0x7f7fffffcd78, a_cnp = 0x7f7ff7bbd3f0,
          a_vap = 0x7f7fdf1d04a8}
#9  0x00007f7ff6c19c68 in RUMP_VOP_CREATE (dvp=dvp@entry=0x7f7fdf398718, vpp=vpp@entry=0x7f7fffffcd78, cnp=cnp@entry=0x7f7ff7bbd3f0,
    vap=vap@entry=0x7f7fdf1d04a8) at /usr/src/lib/librumpvfs/../../sys/rump/librump/rumpvfs/rumpvnode_if.c:89
        error = <optimized out>
#10 0x00007f7ff7404d18 in do_makenode (pu=<optimized out>, pni=0x7f7fffffce70, pcn=<optimized out>, vap=0x7f7fdf1d04a8,
    link_target=link_target@entry=0x0, makefn=0x7f7ff6c19c40 <RUMP_VOP_CREATE>, symfn=symfn@entry=0x0, p2n_dir=<optimized out>)
    at /usr/src/lib/libp2k/p2k.c:802
        p2m = 0x7f7ff7b09000
        dvp = 0x7f7fdf398718
        p2n = 0x7f7fdf38f100
        cn = 0x7f7ff7bbd3f0
        va_x = 0x7f7fdf1d04a8
        vp = 0x0
        rv = <optimized out>
[...]

Please let me know if more information is needed.
>Fix:
N/A

>Unformatted: