kern/39307: mfs will sometimes panic at umount time

[cube%cubidou.net@localhost]

>Number:         39307
>Category:       kern
>Synopsis:       mfs will sometimes panic at umount time
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 07 07:22:43 +0000 2008
>Originator:     Quentin Garnier
>Release:        NetBSD 4.99.72
>Organization:
>Environment:
System: NetBSD leia.cubidou.net 4.99.72 NetBSD 4.99.72 (LEIA) #1: Sat Aug 2 
21:01:58 CEST 2008 
cube%leia.cubidou.net@localhost:/home/cube/src/build/obj/home/cube/src/src/sys/arch/i386/compile/LEIA
 i386
Architecture: i386
Machine: i386
>Description:
        Sometimes at shutdown I get a uvm_fault in the mount_mfs process,
        in VFS_START.  mount_mfs spends most of its life in
        VFS_START/mfs_start.

        What happens is that there is one too many call to vfs_destroy()
        done in the system, which means that when mfs_start() returns,
        the struct mount pointer VFS_START had gotten at mount time is no
        longer valid.

        Note that I don't know if the fact that it doesn't always happen is
        because the extra vfs_destroy call doesn't always happen, or because
        of pure luck and a pointer that still points to mapped data (although
        I think the former because I recall kmem_free going through careful
        steps to make the freed data obviously freed, but I might be wrong).
>How-To-Repeat:
        Use mfs, duh.  In my experience, actually using /tmp for more than the
        X11 socket seems to help reproducing the issue, for some reason.
>Fix:
        Unknown.