assertion: ncp->nc_refs > 0 in cache_drop

[Matthew Dillon]

:Hello.
:I got this assertion with kernel/world as of last Sunday.
:It's been up about 10 hours or so before shutting down and then
:panicked.
:The last operation before the shutdown was building and installing
:XFree86(from CVS). Its /tmp and /usr/obj are nullfs-mount of /var/tmp
:and /var/obj, respectively. Traceback looks to me like it was trying
:to umount /tmp when it panicked.
:
:Regards.

    I went through the code and found a ref count mismatch.  I am hoping
    that it solves the problem but I'm afraid it isn't a smoking gun because
    negative cache entries would only be accessed indirectly via
    cache_purgevfs().  Still, it's possible, especially for /tmp.

					    -Matt

Index: kern/vfs_cache.c
===================================================================
RCS file: /cvs/src/sys/kern/vfs_cache.c,v
retrieving revision 1.9
diff -u -r1.9 vfs_cache.c
--- kern/vfs_cache.c	28 Sep 2003 03:44:02 -0000	1.9
+++ kern/vfs_cache.c	30 Sep 2003 17:23:23 -0000
@@ -599,7 +599,7 @@
 	if (numneg * ncnegfactor > numcache) {
 		ncp = TAILQ_FIRST(&ncneglist);
 		KKASSERT(ncp != NULL);
-		cache_zap(ncp);
+		cache_zap(cache_hold(ncp));
 	}
 }