From owner-freebsd-fs@FreeBSD.ORG  Sat Sep 10 15:28:19 2005
Return-Path: <owner-freebsd-fs@FreeBSD.ORG>
X-Original-To: freebsd-fs@freebsd.org
Delivered-To: freebsd-fs@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4A49D16A459
	for <freebsd-fs@freebsd.org>; Sat, 10 Sep 2005 15:28:19 +0000 (GMT)
	(envelope-from sebastien.bourdeauducq@gmail.com)
Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.200])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7416343D48
	for <freebsd-fs@freebsd.org>; Sat, 10 Sep 2005 15:28:18 +0000 (GMT)
	(envelope-from sebastien.bourdeauducq@gmail.com)
Received: by wproxy.gmail.com with SMTP id i21so1362097wra
	for <freebsd-fs@freebsd.org>; Sat, 10 Sep 2005 08:28:17 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:from:to:subject:date:user-agent:mime-version:content-type:content-transfer-encoding:content-disposition:message-id;
	b=km7XNHAZT7UVmEFN7JH4BLDvCu+Z7BEOmC5wXXZXbMyAOLXnUW/PvXUCCajk/p3MRhNKzosOljkxhgPR+gs564G7bMkNHdMtJuxZK3HPGcsEkmH0QtqfqEUYVrZq9dIFgw3vJ6J9rhuzAxaWSUwbPrMkmoM2RwzLSl88L9AnGoc=
Received: by 10.54.33.57 with SMTP id g57mr1229879wrg;
	Sat, 10 Sep 2005 08:28:17 -0700 (PDT)
Received: from AAmiens-152-1-15-78.w83-192.abo.wanadoo.fr ( [83.192.72.78])
	by mx.gmail.com with ESMTP id 16sm253471wrl.2005.09.10.08.28.15;
	Sat, 10 Sep 2005 08:28:16 -0700 (PDT)
From: Sebastien <sebastien.bourdeauducq@gmail.com>
To: freebsd-fs@freebsd.org
Date: Sat, 10 Sep 2005 17:29:24 +0200
User-Agent: KMail/1.8
MIME-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200509101729.24912.sebastien.bourdeauducq@gmail.com>
Subject: Filesystem access from a KLD causes "vrele: negative ref cnt" panic
X-BeenThere: freebsd-fs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Filesystems <freebsd-fs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-fs>,
	<mailto:freebsd-fs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-fs>
List-Post: <mailto:freebsd-fs@freebsd.org>
List-Help: <mailto:freebsd-fs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-fs>,
	<mailto:freebsd-fs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 10 Sep 2005 15:28:19 -0000

Hello,
When the following kernel code has been run :

------------------------
  struct thread *td = curthread;
  struct nameidata nd;
  int flags, resid;
  struct vattr vat;

  /* Some threads don't have a current working directory, set this to avoid a 
page fault on vn_open() call */
  if(td->td_proc->p_fd->fd_rdir == NULL) td->td_proc->p_fd->fd_rdir = 
rootvnode;
  if(td->td_proc->p_fd->fd_cdir == NULL) td->td_proc->p_fd->fd_cdir = 
rootvnode;
  NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, &filename[0], td);
  flags = FREAD;
  vn_open(&nd, &flags, 0, -1);
  NDFREE(&nd, NDF_ONLY_PNBUF);
  /* Get the file size. */
  VOP_GETATTR(nd.ni_vp, &vat, td->td_ucred, td);
  VOP_UNLOCK(nd.ni_vp, 0, td);
  vn_rdwr(UIO_READ, nd.ni_vp, buf, vat.va_size, 0, UIO_SYSSPACE, 
IO_NODELOCKED, td->td_ucred, NOCRED, &resid, td);
  vn_close(nd.ni_vp, FREAD, td->td_ucred, td);
------------------------

I have a random panic "vrele: negative ref cnt" when I shutdown the system. Am 
I double-freeing something in my code ? The fact that the panic is caused 
randomly suggests there is a synchronization problem - but the above code is 
always running under the protection of the Giant mutex.
Regards,
Sebastien