[robobun]

Problem

• Bun shell mv copies a directory into itself without end when the two paths are on two mounts: mv * out/ with out a mount point. It ends with SIGSEGV (about 12,400 frames of move_across_devices) or Too many open files.
• Across mounts rename(2) returns EXDEV before its EINVAL check. The copy fallback (src/runtime/shell/builtin/mv.rs:502, shell(mv): fall back to copy+unlink when rename() returns EXDEV #36338) then finds its own output in its walk.

Fix

• Before the first mkdirat, the copy checks the directory the destination is made in and each parent of it. If one is the source, it returns EINVAL with nothing made.
• The walk keeps the (st_dev, st_ino) of that directory and returns EINVAL when it reaches it. A tree deeper than the stack returns ENAMETOOLONG.
• Verified: test/js/bun/shell/commands/mv.test.ts (main fails the 8 into-itself cases), bunshell.test.ts, bun run rust:check-all.
• Self-reviewed: 13 concerns raised, 13 addressed.

Background

• rename(2) cannot cross mounts, so the shell copies the tree and removes each source entry after its copy.
• A bind mount shows one directory at two paths. Only st_dev and st_ino show that.
• A bind mount of a child of the source is not below the source by its parents. Only the walk finds it, so both checks stay.

Downsides

• A mount of a child of the source is refused during the walk, after the entries before it are moved (Bun shell mv: a cross-device move that fails midway leaves the tree split between source and destination #44679).
• Not covered (Notes): overlay mounts, cp -R (shell(cp): reject copying a directory into itself; walk cp trees without recursion #38653), node:fs cp (node:fs: stop cp from descending into a directory it is writing into #36355), sources ending in . or .., Windows.
• Cost per cross-device directory operand: one stat per parent of the destination. Stack per level: 384 bytes (main: 336).

Notes

How to reproduce (root, or unshare -Urm):

mkdir -p w/out && cd w && mount -t tmpfs -o nr_inodes=3000,size=16m tmpfs out && touch f1 f2
bun -e 'import {$} from "bun"; $.nothrow(); const r = await $`mv f1 f2 out out/`; console.log(r.exitCode)'

Main: mv: out/out: Too many open files, exit 24, about 2,045 nested directories (hard limit of 4,096 open files). With a hard limit above about 25,000 it is SIGSEGV. With this change: mv: out/out: Invalid argument, exit 22, f1 and f2 are in out.

Layouts. 17 cases on release builds of main (bd599f5) and of this branch: 6 mount layouts (bind mount of the whole file system, the same with an empty destination that exists, bind mount of a child, bind mount of a child on a nested tmpfs, a tmpfs mounted inside the source, mv f1 .. f6 out out/ with out a mount point) by the operand forms mv SRC DIR, mv SRC NEWPATH and mv SRC... DIR.

• Main: 17 of 17 run away.
• This branch: 17 of 17 exit 22. In 11 nothing is made for the operand. The other 6 are the two bind mounts of a child: the refusal comes during the walk and 1 or 2 new directories stay.
• Legal cross-device directory moves give the same result on both builds (into a directory, to a new path, between two mounts of one file system).

What else changes. A destination on a file system that is mounted on a child of the source under a second mount only (mv a/sub b/sub/p1/x, b a bind mount of a, a tmpfs on b/sub/p1). The walk of a/sub does not reach it. Main moves the contents and then fails with EBUSY on the removal of p1, the directory under the mount. This branch refuses it with EINVAL and moves nothing.

File corruption on main. mv f1 .. f7 out out/ runs as two batches on two threads. On main the copy of out walks the destination while the other batch still writes a file there. It copies that file with zero pages in it and removes it, and the other batch then removes the original. Probe: 7 files, out a bind mount of an ext4 directory, open files limited to 64.

	64 MiB files	256 MiB files
main	1 of 20 runs lose a file	2 of 32
this branch	0 of 20	0 of 32

In one lost run the only copy had the full size and 5 of 65,536 4K pages were zero.

Measurements (release, linux x64, main bd599f5 against this branch):

• Syscalls of the mv thread from the renameat on. Same mount, file or directory: 1 to 1. EXDEV file: 16 to 16. EXDEV symlink: 7 to 7. EXDEV directory with 10 files, destination 4 directories below the root: 164 to 170. EXDEV tree with 3 directories, 10 files, 1 symlink: 196 to 202. The added calls are the stat of the destination directory and of each parent up to the root, plus one more at the root.
• Allocator calls inside the walk (3 directories, 10 files, 1 symlink): 32 mi_malloc/mi_zalloc and 28 mi_free, on both builds.
• Stack per level: 336 to 384 bytes (sub $0x118 to sub $0x138, plus a second stack argument). Three ways to pass the identity (by value, &(u64, u64), a &mut Option owned by do_rename) gave the same frame.
• Deepest directory chain that moves across devices (open files raised to 1,000,000): 12,377 on main, then SIGSEGV. 10,497 on this branch, then mv: ...: File name too long. So a chain of 10,498 to 12,377 directories moves on main and is refused here. The refusal keeps the directories it made at the destination, and the chain at the source stays whole.
• Code: move_across_devices 3,316 to 3,546 bytes, new output_directory 1,610 bytes. .text of the stripped binary: 88,771,935 to 88,773,727 bytes (+1,792). bloaty is not installed here, these are from nm -S and size.

Other designs weighed.

• The compare in the walk alone. It stops every layout, but it refuses mv proj proj/cache/ (a mount at proj/cache) only after the rest of proj is moved onto the mount. The check before the first mkdirat refuses that with nothing changed.
• The check before the first mkdirat alone. It cannot see a bind mount of a child of the source.
• A copy pass followed by a removal pass (what GNU mv does), an explicit stack in place of the recursion, and a tree walker shared with cp. Each still needs the compare, and each is a larger change. The copy pass followed by a removal pass is Bun shell mv: a cross-device move that fails midway leaves the tree split between source and destination #44679.
• The st_dev boundary that the shell(mv): fall back to copy+unlink when rename() returns EXDEV #36338 review offered (do not cross a mount point in the walk). A bind mount of the same file system has the same st_dev, and it would change moves that work today.

Not in this change.

• An overlay mount inside the source whose upper layer is the destination. overlayfs shows that directory under another st_dev and st_ino, so no compare finds it. It now ends with ENOSPC, EMFILE or ENAMETOOLONG, where main can end with SIGSEGV. The nested directories stay (in Bun shell mv: a cross-device move that fails midway leaves the tree split between source and destination #44679).
• A source that ends in . or .. is copied across mounts and then fails, where rename(2) on one mount gives EBUSY (in Bun shell mv: a cross-device move that fails midway leaves the tree split between source and destination #44679).
• Shell cp -R a a/sub: shell(cp): reject copying a directory into itself; walk cp trees without recursion #38653 owns the cp walkers. node:fs cp and cpSync: node:fs: stop cp from descending into a directory it is writing into #36355. On main both node:fs calls also copy into themselves through a bind mount of a child of the source.
• Windows: not run, no Windows machine here. A reparse point in the source already fails the existing lstat/fstat compare there. bun run rust:check-all compiles all 12 targets.

Tests. The layouts run in a private mount namespace (unshare -Urm, or unshare -m as root) and the fixture caps each tmpfs at 64 inodes, so main stops with ENOSPC after about 60 levels under any limit. Ran as root and as uid 65534. Without unshare or the right to mount they skip. The deep tree case runs on debug builds only: a release build needs more than 20,000 open files to come to the end of its stack. In CI the mount cases run on 5 of the 11 test lanes (Debian 13 x64, aarch64 and x64-asan, Alpine 3.23 x64 and aarch64). They skip on the two Ubuntu 25.04 lanes, where a user namespace may not mount, and on the macOS and Windows lanes.

---

no test proof · iteration 0 · platform-specific test(s) that do not run on this machine, deferring to CI, which covers all platforms: test/js/bun/shell/commands/mv.test.ts

[robobun]

Status: the fix is in this pull request (#44694).

Reproduced on main (bd599f5) and on the 1.4.3 canary, in a private mount namespace (unshare -Urm, or as root):

mkdir -p w/out && cd w && mount -t tmpfs -o nr_inodes=3000,size=16m tmpfs out && touch f1 f2
bun -e 'import {$} from "bun"; $.nothrow(); const r = await $`mv f1 f2 out out/`; console.log(r.exitCode)'

• Main: mv: out/out: Too many open files, exit 24, about 2,045 nested directories under out. With a hard limit above about 25,000 open files it ends with SIGSEGV.
• This branch: mv: out/out: Invalid argument, exit 22. f1 and f2 are in out and no directory is made.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: oven-sh/bun/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: d35c8934-5776-4033-841c-1a60208da8fc

📥 Commits

Reviewing files that changed from the base of the PR and between bd599f5 and 70fb9e5.

📒 Files selected for processing (3)

• src/runtime/shell/builtin/mv.rs
• test/js/bun/shell/commands/mv-into-itself-fixture.ts
• test/js/bun/shell/commands/mv.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

Walkthrough

The EXDEV fallback for mv now checks destination ancestry and tracks destination directory identity during recursive copies. Tests cover cross-device moves, mount layouts, and deep-tree behavior.

Changes

Cross-device mv directory safety

Layer / File(s)	Summary
Check destination ancestry and guard recursive copies src/runtime/shell/builtin/mv.rs	The EXDEV fallback checks the destination directory and its ancestry against the source. Recursive copies carry the destination’s device and inode identity. Unsafe recursion returns ENAMETOOLONG.
Validate cross-device and mount-layout moves test/js/bun/shell/commands/mv-into-itself-fixture.ts, test/js/bun/shell/commands/mv.test.ts	Tests cover a successful cross-device directory move, mount layouts that must fail or succeed, and a debug-build deep-tree case that expects ENAMETOOLONG.

Suggested reviewers: jarred-sumner

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 70fb9

This change makes cross-device directory moves into themselves fail with an error instead of recursing until the process runs out of file descriptors or crashes. No merge-blocking risk is visible. Overlayfs and Windows behavior are noted as untested.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing mv from copying a directory into itself during the cross-device fallback.
Description check	✅ Passed	The description explains the problem, fix, and verification. It covers the information required by the template, although it uses Problem, Fix, and Verified headings instead of the template head…

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[Jarred-Sumner]

This is Claude (an AI assistant) commenting on Jarred's behalf.

This fix went in with #46021, which is merged. Closing.