From owner-freebsd-current  Wed Mar  6 07:51:12 1996
Return-Path: owner-current
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id HAA29320
          for current-outgoing; Wed, 6 Mar 1996 07:51:12 -0800 (PST)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id HAA29315
          for <freebsd-current@FreeBSD.ORG>; Wed, 6 Mar 1996 07:51:08 -0800 (PST)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.6.12/8.6.9) id CAA27656; Thu, 7 Mar 1996 02:42:16 +1100
Date: Thu, 7 Mar 1996 02:42:16 +1100
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199603061542.CAA27656@godzilla.zeta.org.au>
To: bde@zeta.org.au, davidg@Root.COM
Subject: Re: fixes for rename panic (round 1)
Cc: freebsd-current@FreeBSD.ORG, jhay@mikom.csir.co.za
Sender: owner-current@FreeBSD.ORG
Precedence: bulk

>>***************
>>*** 953,958 ****
>>--- 1005,1012 ----
>>  			panic("ufs_rename: lost to startdir");
>>  		error = relookup(tdvp, &tvp, tcnp);
>>+ 		VREF(tdvp);
>>  		if (error)
>>  			goto out;
>>+ 		vrele(tdvp);
>>  		dp = VTOI(tdvp);
>>  		xp = NULL;

>   It seems like this hunk should be similar to the others - the VREF() should
>be before the call to relookup(). Right?

Right.  The above will probably work because the reference count is > 0
because rename() holds a reference to ni_startdir, so there is no danger
of the reference count going from 0 to -1 in the vput() in relookup().  For
the same reason,  it should work to only add a reference after an error:

	relookup() = ...
	if (error) {
		VREF(tdvp);
		goto out;
	}

but it seems clearer to use a VREF() for each vrele(), at least statically.

My tests only covered the following cases:

- first relookup() called, always succeeded.
- second relookup() never (?) called.
- third relookup() called, sometimes failed.

Bruce