>Number:         24210
>Category:       kern
>Synopsis:       Panic whilst removing a directory
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 23 22:45:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Christian Biere
>Release:        NetBSD 1.6ZH
>Organization:
>Environment:
System: NetBSD cyclonus 1.6ZH NetBSD 1.6ZH (STARSCREAM) #0: Wed Jan 21 07:40:48 CET 2004 bin@cyclonus:/usr/build/src/sys/arch/i386/compile/STARSCREAM i386
Architecture: i386
Machine: i386

     $NetBSD: ffs_alloc.c,v 1.74 2004/01/13 13:38:18 soren Exp $
     $NetBSD: ffs_vfsops.c,v 1.134 2004/01/12 16:19:36 dbj Exp $
     $NetBSD: ufs_inode.c,v 1.42 2003/11/05 10:18:38 hannken Exp $
     $NetBSD: ufs_vnops.c,v 1.109 2003/11/08 06:38:10 dbj Exp $
     $NetBSD: kern_lock.c,v 1.74 2003/12/08 14:21:25 hannken Exp $
     $NetBSD: subr_prf.c,v 1.93 2003/08/07 16:31:53 agc Exp $
     $NetBSD: vfs_subr.c,v 1.215 2004/01/14 11:28:05 yamt Exp $
     $NetBSD: vfs_syscalls.c,v 1.202 2003/12/10 11:40:12 hannken Exp $
     $NetBSD: vfs_vnops.c,v 1.76 2004/01/10 17:16:38 hannken Exp $
     $NetBSD: vnode_if.c,v 1.45 2003/08/07 16:32:05 agc Exp $
     $NetBSD: genfs_vnops.c,v 1.84 2004/01/10 14:39:50 yamt Exp $
     $NetBSD: acpi_machdep.c,v 1.5 2003/10/10 20:16:54 tron Exp $
     $NetBSD: pci_machdep.c,v 1.9 2003/10/30 21:19:54 fvdl Exp $
     $NetBSD: isa_machdep.c,v 1.10 2003/10/30 21:19:54 fvdl Exp $
     $NetBSD: pciide_machdep.c,v 1.3 2003/10/30 21:19:54 fvdl Exp $
     $NetBSD: machdep.c,v 1.547 2003/12/30 12:33:22 pk Exp $
     $NetBSD: process_machdep.c,v 1.50 2003/10/27 14:11:47 junyoung Exp $
     $NetBSD: sys_machdep.c,v 1.70 2003/10/27 14:11:47 junyoung Exp $
     $NetBSD: syscall.c,v 1.27 2003/10/31 03:28:13 simonb Exp $
     $NetBSD: vm_machdep.c,v 1.114 2004/01/04 11:44:52 jdolecek Exp $
     $NetBSD: agp_machdep.c,v 1.4 2002/11/22 15:23:52 fvdl Exp $
     $NetBSD: compat_16_machdep.c,v 1.6 2003/10/27 14:11:46 junyoung Exp $

>Description:
My machine just crashed when I did a rm -rf in my obj directory after
copying netbsd.gdb to /root. It might be relevant that I use /usr
also as a union-mountpoint (not unionfs!) for a partition which
contains pkg and X11R6. The obj directory /usr/build is on the underlying
partition.

(gdb) panic: ifree: freeing free inode
#0  0x00000001 in ?? ()
(gdb) #0  0x00000001 in ?? ()
No symbol table info available.
#1  0xc01fed66 in cpu_reboot (howto=182382592, bootstr=0x0)
    at ../../../../arch/i386/i386/machdep.c:731
No locals.
#2  0xc01a02b4 in panic (
    fmt=0x1000 "U\211åVWS\036\006\017 \017¨\213E\bf£à\037")
    at ../../../../kern/subr_prf.c:242
	bootopt = 182378496
#3  0xc0187951 in lockmgr (lkp=0xc8161ce4, flags=65554, interlkp=0xc8161c74)
    at ../../../../kern/kern_lock.c:852
	error = 11
	pid = 8299
	lid = 1
	extflags = 0
	l = (struct lwp *) 0x0
	lock_shutdown_noblock = 0
	s = 0
#4  0xc01c89fd in genfs_lock (v=0xc0284089)
    at ../../../../miscfs/genfs/genfs_vnops.c:324
	vp = (struct vnode *) 0x0
#5  0xc01c78c0 in VOP_LOCK (vp=0x0, flags=-1071103863)
    at ../../../../kern/vnode_if.c:1108
	a = {a_desc = 0xc0278920, a_vp = 0xc8161c74, a_flags = 65554}
#6  0xc01c70f1 in vn_lock (vp=0xc8161c74, flags=65554)
    at ../../../../kern/vfs_vnops.c:779
	error = -1071103863
#7  0xc01becab in vget (vp=0xc8161c74, flags=0)
    at ../../../../kern/vfs_subr.c:1240
	error = 0
#8  0xc015bfba in ffs_sync (mp=0xc0879800, waitfor=2, cred=0xc09f3080, 
    p=0xc6d33804) at ../../../../ufs/ffs/ffs_vfsops.c:1281
	vp = (struct vnode *) 0xc8161c74
	nvp = (struct vnode *) 0xc811e264
	ip = (struct inode *) 0xc0284089
	ump = (struct ufsmount *) 0xc0879400
	fs = (struct fs *) 0xc08a9000
	error = -1071103863
	count = 49
	allerror = 0
#9  0xc01c1b7a in sys_sync (l=0xc0284089, v=0x0, retval=0x0)
    at ../../../../kern/vfs_syscalls.c:616
	mp = (struct mount *) 0xc0879800
	nmp = (struct mount *) 0x0
	asyncflag = 0
	p = (struct proc *) 0xc6d33804
#10 0xc01c030b in vfs_shutdown () at ../../../../kern/vfs_subr.c:2620
	l = (struct lwp *) 0xc6d359d0
	p = (struct proc *) 0xc6d33804
#11 0xc01fed7a in cpu_reboot (howto=256, bootstr=0x0)
    at ../../../../arch/i386/i386/machdep.c:717
No locals.
#12 0xc01a02b4 in panic (fmt=0x0) at ../../../../kern/subr_prf.c:242
	bootopt = 256
#13 0xc015507d in ffs_freefile (v=0xc743bdb4)
    at ../../../../ufs/ffs/ffs_alloc.c:1765
	cgp = (struct cg *) 0xc6f9e008
	pip = (struct inode *) 0xc8157848
	fs = (struct fs *) 0xc08a9000
	ino = 573395
	bp = (struct buf *) 0xc09741b4
	error = 19
	inosused = (u_int8_t *) 0xc6f9e0f0 "\037\200"
#14 0xc01c7afe in VOP_VFREE (pvp=0x0, ino=3223863433, mode=-1071103863)
    at ../../../../kern/vnode_if.c:1455
	a = {a_desc = 0xc0278be0, a_pvp = 0xc8161c74, a_ino = 573395, 
  a_mode = 16877}
#15 0xc015f81c in ufs_inactive (v=0xc0284089)
    at ../../../../ufs/ufs/ufs_inode.c:112
	vp = (struct vnode *) 0xc8161c74
	ip = (struct inode *) 0xc8157848
	mp = (struct mount *) 0xc0879800
	p = (struct proc *) 0xc6d33804
	mode = 16877
	error = 0
#16 0xc01c7868 in VOP_INACTIVE (vp=0x0, p=0xc0284089)
    at ../../../../kern/vnode_if.c:1050
	a = {a_desc = 0xc02788a0, a_vp = 0xc8161c74, a_p = 0xc6d33804}
#17 0xc01bedb9 in vput (vp=0x0) at ../../../../kern/vfs_subr.c:1315
No locals.
#18 0xc0163a1c in ufs_rmdir (v=0xc0284089)
    at ../../../../ufs/ufs/ufs_vnops.c:1490
	vp = (struct vnode *) 0xc8161c74
	dvp = (struct vnode *) 0xc7ed5e40
	cnp = (struct componentname *) 0xc743bef8
	ip = (struct inode *) 0xc8157848
	dp = (struct inode *) 0xc810af28
	error = 0
#19 0xc01c7762 in VOP_RMDIR (dvp=0x0, vp=0xc0284089, cnp=0xc0284089)
    at ../../../../kern/vnode_if.c:889
	a = {a_desc = 0xc0278760, a_dvp = 0xc7ed5e40, a_vp = 0xc8161c74, 
  a_cnp = 0xc743bef8}
#20 0xc01c5f63 in sys_rmdir (l=0xc0284089, v=0xc743bf64, retval=0xc743bf5c)
    at ../../../../kern/vfs_syscalls.c:3383
	p = (struct proc *) 0xc6d33804
	mp = (struct mount *) 0xc0879800
	vp = (struct vnode *) 0xc8161c74
	error = -951861552
	nd = {ni_dirp = 0x8056040 <Address 0x8056040 out of bounds>, 
  ni_segflg = UIO_USERSPACE, ni_startdir = 0x0, ni_rootdir = 0xc6935000, 
  ni_vp = 0xc8161c74, ni_dvp = 0xc7ed5e40, ni_pathlen = 1, 
  ni_next = 0xc7197804 "", ni_loopcnt = 0, ni_cnd = {cn_nameiop = 2, 
    cn_flags = 32780, cn_proc = 0xc6d33804, cn_cred = 0xc09f3080, 
    cn_pnbuf = 0xc7197800 "x68k", cn_nameptr = 0xc7197800 "x68k", 
    cn_namelen = 4, cn_hash = 2156185768, cn_consume = 0}}
#21 0xc0205bda in syscall_plain (frame=0xc743bfa8)
    at ../../../../arch/i386/i386/syscall.c:156
	params = 0x0
	callp = (const struct sysent *) 0xc02a584c
	l = (struct lwp *) 0xc6d359d0
	p = (struct proc *) 0xc0284089
	error = -1071103863
	argsize = 3223863433
	code = 0
	args = {134570048, -1077937520, -1077937400, 0, 0, -951861352, 
  -1071675358, -951861340}
	rval = {0, 0}

>How-To-Repeat:

# cd /usr/build
# cp src/sys/arch/i386/compile/STARSCREAM/netbsd.gdb $HOME
# rm -rf src

>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted: