=== DF-0855 dirfs_findfd KKASSERT panic / NULL deref === setup: root=0x8004904c0 (fd=3, isroot), file=0x8004904a0 (fd=DIRFS_NOFD, parent=root) file->dn_parent = 0x8004904c0 (valid) [happy path, parent intact] BUGGY: pathnp=0x8004904c0 panic=0 path="file.txt" (expect panic=0, path set) FIXED: pathnp=0x8004904c0 panic=0 path="file.txt" (expect panic=0, path set) [AFTER dirfs_nremove: file->dn_parent = NULL (unlinked, vnode alive)] file->dn_parent = 0x0 [fstat(fd) -> VOP_GETATTR -> dirfs_getattr -> dirfs_findfd] BUGGY: pathnp=0x0 panic=1 ** PANIC: assertion "dnp1 != NULL" failed in dirfs_findfd at dirfs_subr.c:480 ** => kernel panic (KKASSERT w/ INVARIANTS) or NULL deref (without) FIXED: pathnp=0x0 tmp=NULL pf=0x0 (expect NULL — caller returns ESTALE) => no panic, no leak; caller (dirfs_getattr) returns ESTALE === SUMMARY === DF_0855_BUG_PANIC_ON_UNLINKED_NODE = YES (KKASSERT fires) DF_0855_FIX_RETURNS_NULL_NO_PANIC = YES RUN_EXIT=0 ---RUN2--- === DF-0855 dirfs_findfd KKASSERT panic / NULL deref === setup: root=0x8004904c0 (fd=3, isroot), file=0x8004904a0 (fd=DIRFS_NOFD, parent=root) file->dn_parent = 0x8004904c0 (valid) [happy path, parent intact] BUGGY: pathnp=0x8004904c0 panic=0 path="file.txt" (expect panic=0, path set) FIXED: pathnp=0x8004904c0 panic=0 path="file.txt" (expect panic=0, path set) [AFTER dirfs_nremove: file->dn_parent = NULL (unlinked, vnode alive)] file->dn_parent = 0x0 [fstat(fd) -> VOP_GETATTR -> dirfs_getattr -> dirfs_findfd] BUGGY: pathnp=0x0 panic=1 ** PANIC: assertion "dnp1 != NULL" failed in dirfs_findfd at dirfs_subr.c:480 ** => kernel panic (KKASSERT w/ INVARIANTS) or NULL deref (without) FIXED: pathnp=0x0 tmp=NULL pf=0x0 (expect NULL — caller returns ESTALE) => no panic, no leak; caller (dirfs_getattr) returns ESTALE === SUMMARY === DF_0855_BUG_PANIC_ON_UNLINKED_NODE = YES (KKASSERT fires) DF_0855_FIX_RETURNS_NULL_NO_PANIC = YES RUN_EXIT=0 ---RUN3--- === DF-0855 dirfs_findfd KKASSERT panic / NULL deref === setup: root=0x8004904c0 (fd=3, isroot), file=0x8004904a0 (fd=DIRFS_NOFD, parent=root) file->dn_parent = 0x8004904c0 (valid) [happy path, parent intact] BUGGY: pathnp=0x8004904c0 panic=0 path="file.txt" (expect panic=0, path set) FIXED: pathnp=0x8004904c0 panic=0 path="file.txt" (expect panic=0, path set) [AFTER dirfs_nremove: file->dn_parent = NULL (unlinked, vnode alive)] file->dn_parent = 0x0 [fstat(fd) -> VOP_GETATTR -> dirfs_getattr -> dirfs_findfd] BUGGY: pathnp=0x0 panic=1 ** PANIC: assertion "dnp1 != NULL" failed in dirfs_findfd at dirfs_subr.c:480 ** => kernel panic (KKASSERT w/ INVARIANTS) or NULL deref (without) FIXED: pathnp=0x0 tmp=NULL pf=0x0 (expect NULL — caller returns ESTALE) => no panic, no leak; caller (dirfs_getattr) returns ESTALE === SUMMARY === DF_0855_BUG_PANIC_ON_UNLINKED_NODE = YES (KKASSERT fires) DF_0855_FIX_RETURNS_NULL_NO_PANIC = YES RUN_EXIT=0