"panic: vrele: negative ref cnt" on RELENG_5

[Tai-hwa Liang]

Hi,

  I ran into this panic on a Pentium 4 box two hours ago; however, there's
no backtrace available since the box was booted with 5.3-BETA6-i386-disc2:

	panic: vrele: negative ref cnt
	boot() called on cpu#1
	Uptime: 8h54m1s

  The operations performed before the panic took place were:

	mount /dev/ad4s3f /mnt			# an UFS1 FreeBSD slice
	mkdir /mnt3
	mount_msdosfs /dev/ad5s3 /mnt3		# a FAT32 partition
	bsdtar -cpvf /mnt3/backup.tar /mnt
	^D					# leave the FIXIT shell, BOOM!

  Not sure this is relevant, but there're a couple of "ad4: FAILURE ...
UNCORRETABLE.. LBA=xxx..." errors while bsdtar was running.

On Wed, 29 Sep 2004, Kris Kennaway wrote:
> An amd64 machine I updated 5 days ago panicked with this at reboot
> time:
>
> Waiting (max 60 seconds) for system process `vnlru' to stop...done
> Waiting (max 60 seconds) for system process `bufdaemon' to stop...done
> Waiting (max 60 seconds) for system process `syncer' to stop...
> Syncing disks, vnodes remaining...1 1 1 0 0 done
> No buffers busy after final sync
> panic: vrele: negative ref cnt
> kdb_enter() at kdb_enter+0x2f
> panic() at panic+0x1d2
> vrele() at vrele+0x1ec
> ffs_unmount() at ffs_unmount+0x182
> dounmount() at dounmount+0x171
> vfs_unmountall() at vfs_unmountall+0x50
> boot() at boot+0x809
> reboot() at reboot+0x3d
> syscall() at syscall+0x4ab
> Xfast_syscall() at Xfast_syscall+0xa8
> --- syscall (55, FreeBSD ELF64, reboot), rip = 0x20076d76c, rsp = 0x7fffffffebb8, rbp = 0x1b0ab ---