kern/103245: mount -o rw, umount may panic system

[Martin]

>Number:         103245
>Category:       kern
>Synopsis:       mount -o rw, umount may panic system
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 13 23:10:17 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Martin
>Release:        FreeBSD 6.1R
>Organization:
>Environment:
FreeBSD 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Sat May 13 00:26:37 CEST 2006
>Description:
Under certain circumstances, it is possible to cause a panic while remounting
and unmounting an originally read-only mounted UFS file system.

>How-To-Repeat:
fstab which I'm using contains entries to my old FreeBSD installation:

[...]
/dev/ad0s3a            /freebsd-old            ufs     ro      0       0
/dev/ad0s3f            /freebsd-old/var        ufs     ro      0       0
/dev/ad0s3d            /freebsd-old/usr        ufs     ro      0       0
/dev/ad0s3e            /freebsd-old/usr/home   ufs     ro      0       0

Everything is read-only and mounted after boot. Now, try to remount:

# mount -o rw /freebsd-old/usr/home
# mount

[...]
/dev/ad0s3a on /freebsd-old (ufs, local, read-only)
/dev/ad0s3f on /freebsd-old/var (ufs, local, read-only)
/dev/ad0s3d on /freebsd-old/usr (ufs, local, read-only)
/dev/ad0s3e on /freebsd-old/usr/home (ufs, local, read-only)
/dev/ad0s3e on /freebsd-old/usr/home (ufs, local, read-only)

You see two entries of /dev/ad0s3e, both of them read-only. From here on, try a few more "mount -o rw /freebsd-old/usr/home" and "umount /freebsd-old/usr/home". This will result in a panic.

(Note:
# mount -o rw /dev/ad0s3e /freebsd-old/usr/home
mount: /dev/ad0s3e: Operation not permitted

Please reproduce it, exactly with the steps above.
)

>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: