>Number:         13419
>Category:       kern
>Synopsis:       panic when remounting root as R/W when having a MFS union mount on root
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 09 10:44:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Emmanuel Dreyfus
>Release:        NetBSD-current
>Organization:
The NetBSD Project
>Environment:
>Description:
When root partition is mounted read-only and we have an union mount with 
a memory file system (MFS), remounting root as read/write causes a panic.
The problem has been perfectly reproductible on NetBSD-1.5/i386 and
NetBSD-current/macppc.
>How-To-Repeat:
Go to single use (not mandatory, but it's easier to mount / read-only
in single user mode), and try this (replace sd0a by your root partition)
root@violette[/root]#mkdir /tmp/mfs
root@violette[/root]#mount_mfs swap /tmp/mfs
root@violette[/root]#mount -o ro /dev/sd0a /
root@violette[/root]#mount_union /tmp/mfs /dev
root@violette[/root]#mount -o rw /dev/sd0a /
panic: lockmgr: release of unlocked lock!
Stopped in pid 23521 (mount) at cpu_Debugger+0x10:      lwz     r0, r1, 0x14,
db> trace
0xe6875ca0: at panic+134
0xe6875d50: at lockmgr+a50
0xe6875d80: at genfs_unlock+20
0xe6875d90: at VOP_UNLOCK+38
0xe6875db0: at spec_close+190
0xe6875de0: at ufsspec_close+1bc
0xe6875e10: at union_close+70
0xe6875e20: at VOP_CLOSE+40
0xe6875e50: at vn_close+60
0xe6875e70: at vn_closefile+20
0xe6875e80: at closef+204
0xe6875ec0: at fdrelease+b4
0xe6875ed0: at sys_close+2c
0xe6875ee0: at trap+3fc
0xe6875f50: user SC trap by 0x18449e8: srr1=0xd032
            r1=0x7fffe480 cr=0x40000000 xer=0x20000000 ctr=0x18445f4
  <????>  : at 0x18019f8
db>
>Fix:
Nothing yet!
>Release-Note:
>Audit-Trail:
>Unformatted: