gjournal panic on RELENG_6

Hi there

remounting gjournalled filesystem read-only leaves some kernel structures 
unflushed, leading to a panic.

Reproduce sequence:

/ar is gjournalled

mount -t devfs devfs /ar/tmp
mount -u -r /ar

... after several seconds (I suppose on gjournal switch) kernel panicked:


marck_at_beast:/var/crash# kgdb /usr/obj/usr/src/sys/MINI-GJ/kernel.debug vmcore.0
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: 
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: ffs_sbupdate: write read-only filesystem
Uptime: 7m31s
GEOM_JOURNAL: Shutting down geom gjournal 3749553006.
Dumping 1007 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 1007MB (257728 pages) 991 975 959 943 927 911 895 879 863 847 831 
815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527 511 
495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 
175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:172
172     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:172
#1  0x0000000000000004 in ?? ()
#2  0xffffffff801ee5e3 in boot (howto=260) at 
/usr/src/sys/kern/kern_shutdown.c:409
#3  0xffffffff801eebe6 in panic (fmt=0xffffff003cb7b4c0 "\200\226╥<") at 
/usr/src/sys/kern/kern_shutdown.c:565
#4  0xffffffff802b8044 in ffs_sbupdate (mp=0xffffff002069a400, waitfor=1, 
suspended=1) at /usr/src/sys/ufs/ffs/ffs_vfsops.c:1494
#5  0xffffffff8055a2fe in ?? ()
#6  0x0000000000000000 in ?? ()
Previous frame identical to this frame (corrupt stack?)


Sincerely,
D.Marck                                     [DM5020, MCK-RIPE, DM3-RIPN]
------------------------------------------------------------------------
*** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck_at_rinet.ru ***
------------------------------------------------------------------------