From owner-freebsd-current  Sat Mar  2 05:59:44 1996
Return-Path: owner-current
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id FAA14379
          for current-outgoing; Sat, 2 Mar 1996 05:59:44 -0800 (PST)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id FAA14372
          for <freebsd-current@FreeBSD.ORG>; Sat, 2 Mar 1996 05:59:41 -0800 (PST)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.6.12/8.6.9) id AAA07828; Sun, 3 Mar 1996 00:51:52 +1100
Date: Sun, 3 Mar 1996 00:51:52 +1100
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199603021351.AAA07828@godzilla.zeta.org.au>
To: jhay@mikom.csir.co.za, terry@lambert.org
Subject: Re: rename panics kernel
Cc: freebsd-current@FreeBSD.ORG
Sender: owner-current@FreeBSD.ORG
Precedence: bulk

>> > Resently I got a "panic : vrele : negative reference count".
>> > The vrele() was called from rename().
>> > 
>> > I tried a simple script to exercise rename (attached below) and a
>> > current system seems to panic (trapped in ufs_rename).  There's a race
>> > ...

>Tee Hee Hee.

>I tried this on -current and my box panic'ed too.

I couldn't duplicate this with my version of -current, but plain -current
on an 8MB system gave:

	panic: vm_fork: u_map allocation failed

and after rebooting it paniced in savecore:

	panic: bremfree: removing a buffer when not on a queue

and on a 16MB system the mv script trapped for a null pointer:

	Stopped at  _ufs_remove+0x15:  movl 0x68(%ecx),%edi
	[%ecx = 0; %ecx is ap->a_vp]

The fix is a side effect of my reordering for single-entry/single-exit
and the semantic changes for the:

It must be a side effect of something I've changed too :-).  In
ufs_rename(), I only changed most of the IN_CHANGE's to IN_MODIFIED.
This stops the directory ctimes from being updated for failed renames.
I don't think this would affect the bug.

Bruce