[Bug 207464] Panic when destroying ZFS snapshot on boot filesystem

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207464

            Bug ID: 207464
           Summary: Panic when destroying ZFS snapshot on boot filesystem
           Product: Base System
           Version: 10.2-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: dustinwenz at ebureau.com
                CC: freebsd-amd64 at FreeBSD.org
                CC: freebsd-amd64 at FreeBSD.org

FreeBSD 10.3-PRERELEASE #13 r295115M: Mon Feb  1 13:08:30 CST 2016

When destroying a ZFS snapshot of the boot filesystem, the system panicked with
the message:

vputx: negative ref cnt

KDB stack backtrace:

vputx: negative ref count
0xfffff801d7ab7b10: tag zfs, type VDIR
    usecount 0, writecount 0, refcount 0 mountedhere 0
    flags (VI_FREE)
 VI_LOCKed    lock type zfs: EXCL by thread 0xfffff80448797960 (pid 7211, zfs,
tid 101642)
panic: vputx: negative ref cnt
cpuid = 13
KDB: stack backtrace:
#0 0xffffffff8098f7f0 at kdb_backtrace+0x60
#1 0xffffffff80952896 at vpanic+0x126
#2 0xffffffff80952763 at panic+0x43
#3 0xffffffff809f94e5 at vputx+0x2d5
#4 0xffffffff809f2a99 at dounmount+0x689
#5 0xffffffff81a851d4 at zfs_unmount_snap+0x114
#6 0xffffffff81a884f1 at zfs_ioc_destroy_snaps+0xc1
#7 0xffffffff81a86f54 at zfsdev_ioctl+0x664
#8 0xffffffff80837469 at devfs_ioctl_f+0x139
#9 0xffffffff809aa085 at kern_ioctl+0x255
#10 0xffffffff809a9d80 at sys_ioctl+0x140
#11 0xffffffff80d68aff at amd64_syscall+0x40f
#12 0xffffffff80d4dd7b at Xfast_syscall+0xfb
Uptime: 4h4m41s


(kgdb) bt
#0  __curthread () at ./machine/pcpu.h:219
#1  doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:298
#2  0xffffffff809524f2 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:486
#3  0xffffffff809528d5 in vpanic (fmt=<optimized out>, ap=<optimized out>) at
/usr/src/sys/kern/kern_shutdown.c:889
#4  0xffffffff80952763 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:818
#5  0xffffffff809f94e5 in vputx (vp=0xfffff801d7ab7b10, func=<optimized out>)
at /usr/src/sys/kern/vfs_subr.c:2510
#6  0xffffffff809f2a99 in dounmount (mp=0xfffff80142dc4660, flags=<optimized
out>, td=<optimized out>) at /usr/src/sys/kern/vfs_mount.c:1359
#7  0xffffffff81a851d4 in zfs_unmount_snap (snapname=<optimized out>) at
/usr/src/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c:3485
#8  0xffffffff81a884f1 in zfs_ioc_destroy_snaps (poolname=0xfffffe00170f8000
"zroot", innvl=<optimized out>, outnvl=0xfffff804488297a0) at
/usr/src/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c:3558
#9  0xffffffff81a86f54 in zfsdev_ioctl (dev=<optimized out>, zcmd=<optimized
out>, arg=<optimized out>, flag=<optimized out>, td=<optimized out>) at
/usr/src/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c:6278
#10 0xffffffff80837469 in devfs_ioctl_f (fp=0xfffff8001ff5b8c0, com=3222821411,
data=0xfffffe085e28b8e0, cred=<optimized out>, td=0xfffff80448797960) at
/usr/src/sys/fs/devfs/devfs_vnops.c:786
#11 0xffffffff809aa085 in fo_ioctl (fp=<optimized out>, com=<optimized out>,
data=<optimized out>, active_cred=<optimized out>, td=<optimized out>,
fp=<optimized out>, com=<optimized out>, data=<optimized out>,
active_cred=<optimized out>, td=<optimized out>) at /usr/src/sys/sys/file.h:321
#12 kern_ioctl (td=0xfffff80448797960, fd=<optimized out>, com=<unavailable>)
at /usr/src/sys/kern/sys_generic.c:809
#13 0xffffffff809a9d80 in sys_ioctl (td=0xfffff80448797960,
uap=0xfffffe085e28ba40) at /usr/src/sys/kern/sys_generic.c:718
#14 0xffffffff80d68aff in syscallenter (td=<optimized out>, sa=<optimized out>,
td=<optimized out>, sa=<optimized out>) at
/usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:141
#15 amd64_syscall (td=0xfffff80448797960, traced=0) at
/usr/src/sys/amd64/amd64/trap.c:959
#16 <signal handler called>
#17 0x0000000801a05f1a in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffffffc8c8

-- 
You are receiving this mail because:
You are on the CC list for the bug.