executor: remove_dir() unable to handle disconnected directories

[a-nogikh]

The seed added in #6164 causes our remove_dir function to fail.

The (somewhat) minimalized version is as follows:

mkdirat(0xffffffffffffff9c, &AUTO='./file0\x00', 0x1c0)
mount$tmpfs(0x0, &AUTO='./file0\x00', &AUTO='tmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1\x00', 0x1c0)
mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1/file2\x00', 0x1c0)
mkdirat(0xffffffffffffff9c, &AUTO='./file0/file1/file2/file3\x00', 0x1c0)
mkdirat(0xffffffffffffff9c, &AUTO='./file0/file6\x00', 0x1c0)
mount$bind(&AUTO='./file0/file1/file2/file3\x00', &AUTO='./file0/file1/file2/file3\x00', 0x0, 0x1000, 0x0)
mount$bind(&AUTO='./file0/file1\x00', &AUTO='./file0/file6\x00', 0x0, 0x5000, 0x0)
renameat2(0xffffffffffffff9c, &AUTO='./file0/file1/file2\x00', 0xffffffffffffff9c, &AUTO='./file0/file2\x00', 0x0)

proc 0: got output: umount(./0/file0/file2/file3)
umount(./0/file0/file2/file3)
umount(./0/file0/file2/file3) failed (errno 22)
remove_dir_fail none/cover C/repeat C/thr/cover C/repeat C: FAIL: should repeat 3 times, but repeated 1, prog calls [0xc0134512c0 0xc013451310 0xc013451360 0xc0134513b0 0xc013451400 0xc013451450 0xc0134514a0 0xc0134514f0 0xc013451540], info calls -1
        Setting up swapspace version 1, size = 127995904 bytes
        executing program
        ### start
        ### call=0 errno=0
        ### call=1 errno=0
        ### call=2 errno=0
        ### call=3 errno=0
        ### call=4 errno=0
        ### call=5 errno=0
        ### call=6 errno=0
        ### call=7 errno=0
        ### call=8 errno=0
        the reproducer may not work as expected: 802154 injection setup failed: NL802154_CMD_SET_SHORT_ADDR failed
        the reproducer may not work as expected: 802154 injection setup failed: NL802154_CMD_SET_SHORT_ADDR failed
        the reproducer may not work as expected: 802154 injection setup failed: NL802154_CMD_SET_SHORT_ADDR failed

        Setting up swapspace version 1, size = 127995904 bytes
        executing program
        ### start
        ### call=0 errno=0
        ### call=1 errno=0
        ### call=2 errno=0
        ### call=3 errno=0
        ### call=4 errno=0
        ### call=5 errno=0
        ### call=6 errno=0
        ### call=7 errno=0
        ### call=8 errno=0
        the reproducer may not work as expected: 802154 injection setup failed: NL802154_CMD_SET_SHORT_ADDR failed
        the reproducer may not work as expected: 802154 injection setup failed: NL802154_CMD_SET_SHORT_ADDR failed

The issue is also reproducible by running C reproducers directly:

./bin/syz-prog2c -tmpdir -repeat 3 -prog sys/linux/test/remove_dir_fail

On the VM:

# rm -rf syzkaller.3Z2rX4/
rm: can't remove 'syzkaller.3Z2rX4/0/file0/file2/file3': Device or resource busy
rm: can't remove 'syzkaller.3Z2rX4/0/file0/file6': Device or resource busy
# umount syzkaller.3Z2rX4/0/file0/file6
umount: can't unmount /root/syzkaller.3Z2rX4/0/file0/file6: Device or resource busy
# umount syzkaller.3Z2rX4/0/file0/file2/file3
umount: can't unmount syzkaller.3Z2rX4/0/file0/file2/file3: Invalid argument
# mount
< ... >
none on /root/syzkaller.3Z2rX4/0/file0 type tmpfs (rw,relatime)
none on /root/syzkaller.3Z2rX4/0/file0/file6 type tmpfs (rw,relatime)
# cat /proc/self/mountinfo 
< ... >
43 27 0:34 / /root/syzkaller.3Z2rX4/0/file0 rw,relatime - tmpfs none rw
45 43 0:34 /file1//deleted /root/syzkaller.3Z2rX4/0/file0/file6 rw,relatime - tmpfs none rw
# umount /root/syzkaller.3Z2rX4/0/file0/file6
umount: can't unmount /root/syzkaller.3Z2rX4/0/file0/file6: Device or resource busy
# umount /file1//deleted
umount: can't unmount /file1//deleted: No such file or directory

[a-nogikh]

Lazy umount (umount -l) works in this case, but I am not sure it's the solution we want in our executor.

[dvyukov]

Lazy umount (umount -l) works in this case, but I am not sure it's the solution we want in our executor.

Does it actually eventually unmount it, or just does not fail?

[a-nogikh]

In this particular case, the records disappear from /proc/self/mountinfo and it becomes possible to rm -rf the directory