From owner-freebsd-current  Mon Oct  2 13:14:49 1995
Return-Path: owner-current
Received: (from root@localhost)
          by freefall.freebsd.org (8.6.12/8.6.6) id NAA20247
          for current-outgoing; Mon, 2 Oct 1995 13:14:49 -0700
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.34])
          by freefall.freebsd.org (8.6.12/8.6.6) with ESMTP id NAA20236
          for <current@freebsd.org>; Mon, 2 Oct 1995 13:14:42 -0700
Received: (from bde@localhost) by godzilla.zeta.org.au (8.6.9/8.6.9) id GAA09018; Tue, 3 Oct 1995 06:12:36 +1000
Date: Tue, 3 Oct 1995 06:12:36 +1000
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199510022012.GAA09018@godzilla.zeta.org.au>
To: ville@vlsi.fi
Subject: Re: kern/760: mv foo/ ../.. causes panic
Cc: current@freebsd.org
Sender: owner-current@freebsd.org
Precedence: bulk

>Executing the following commands cause panic:
>descent% mkdir foo
>descent% mv foo/ ../..

>This results:
>panic: relookup: lookup on dot-dot

>It appears that mv tries to rename foo/ to ../../ which would cause bad
>things to happen if succesful.

There seem to be several bugs.  First, /bin/mv is confused by the
trailing slash on "foo/" and attempts to do a rename("foo/", "../../")
when it should do a rename("foo/", "../../foo/").  Second, ufs_rename()
thinks that the target directory (".." here, unless ".." is the root
directory) can never be ".." but this example shows that the assumption
is invalid.  Third, the bug was masked in versions of FreeBSD before
2.1-stable because rename("foo/", "../../") fails earlier for the wrong
reason (because of the trailing slash).  2.0.5 panics for the variant
rename("foo", "../..") but /bin/mv would never generate this.

Fix: in the kernel, it seems best to handle renaming to "../.." the same
as renaming to ".." and return ENOTEMPTY.

Bruce