Where v_rdev structure of struct vnode is filled?

[Dmitry Sivachenko]

Hello!

I am investigating the following panic (on -stable):

mount_nullfs /dev /null

Run the following program:

main() {
int fd, type;

fd = open("/null/zero", O_RDONLY, 0);
ioctl(fd, FIODTYPE, &type);
}

When in vn_ioctl() v_rdev structure of (struct vnode *)fp->f_data is NULL.
System will panic in devsw(), because v_rdev is being dereferenced in it.

If we use "/dev/zero" instead of "/null/zero" everything is OK.
I am asking for some help to figure out where this structure is filled
when we do not use nullfs.

Thanks!