illumos gate

Steps to reproduce:

#!/bin/ksh

TESTPOOL=rpool
TESTFS=fs
TESTVOL=vol

zfs create $TESTPOOL/$TESTFS
zfs create -V 1M $TESTPOOL/$TESTFS/$TESTVOL
stat /dev/zvol/rdsk/$TESTPOOL/$TESTFS/$TESTVOL
zfs destroy -r $TESTPOOL/$TESTFS
zfs create -V 1M $TESTPOOL/$TESTFS
stat /dev/zvol/rdsk/$TESTPOOL/$TESTFS

Panic info:

> ::panicinfo                                                                                                                                                                                                                                             [1/31]
             cpu                0
          thread ffffff040a987400
         message assertion failed: dv->sdev_nlink == 1, file: ../../common/fs/dev/sdev_subr.c, line: 3133
             rdi fffffffffbf639e0
             rsi ffffff0011af2470
             rdx fffffffffb9c1870
             rcx              c3d
              r8 fffffffffbe6a035
              r9                0
             rax ffffff0011af2490
             rbx ffffff0419b4a300
             rbp ffffff0011af24d0
             r10                1
             r11                1
             r12 ffffff04133a4820
             r13 ffffff04133a4848
             r14 ffffff04071c0c68
             r15 ffffff03ed376580
          fsbase                0
          gsbase fffffffffbc476c0
              ds               4b
              es               4b
              fs                0
              gs              1c3
          trapno                0
             err                0
             rip fffffffffb86d500
              cs               30
          rflags              282
             rsp ffffff0011af2468
              ss               38
          gdt_hi                0
          gdt_lo         e00001ef
          idt_hi                0
          idt_lo         d0000fff
             ldt                0
            task               70
             cr0         80050033
             cr2          807b098
             cr3        1fffa0000
             cr4            406f8
> ::stack
vpanic()
0xfffffffffbe18678()
devname_inactive_func+0x99(ffffff0419b4a300, ffffff04071c0c68, 0)
sdev_inactive+0x1b(ffffff0419b4a300, ffffff04071c0c68, 0)
fop_inactive+0x76(ffffff0419b4a300, ffffff04071c0c68, 0)
vn_rele+0x82(ffffff0419b4a300)
devname_lookup_func+0x701(ffffff0412e615a0, ffffff0011af29b0, ffffff0011af29a8, ffffff04071c0c68, fffffffffb9ba460, 8)
devzvol_lookup+0x2ae(ffffff0412e49800, ffffff0011af29b0, ffffff0011af29a8, ffffff0011af2c00, 0, ffffff03e9fee800)
fop_lookup+0xa2(ffffff0412e49800, ffffff0011af29b0, ffffff0011af29a8, ffffff0011af2c00, 0, ffffff03e9fee800)
lookuppnvp+0x230(ffffff0011af2c00, 0, 0, 0, ffffff0011af2df8, ffffff03e9fee800)
lookuppnatcred+0x15e(ffffff0011af2c00, 0, 0, 0, ffffff0011af2df8, 0)
lookupnameatcred+0xdd(8047d0d, 0, 0, 0, ffffff0011af2df8, 0)
lookupnameat+0x39(8047d0d, 0, 0, 0, ffffff0011af2df8, 0)
cstatat_getvp+0x107(ffd19553, 8047d0d, 0, ffffff0011af2df8, ffffff0011af2df0)
cstatat64_32+0x6f(ffd19553, 8047d0d, 8047ae8, 1000, 0)
fstatat64_32+0x42(ffd19553, 8047d0d, 8047ae8, 1000)
lstat64_32+0x25(8047d0d, 8047ae8)
sys_syscall32+0x1f7()

1. In case of ZFS filesystem with nested child datasets we have /dev/zvol/*dsk directories hierarchy /dev/zvol/*dsk/pool/filesystem/child1/child2/child3
2. When pool/filesystem/child1 filesystem and its children datasets are destroyed, all /dev/zvol/*dsk directories hierarchy for pool/filesystem/child1 and sdev cache still exists (by design of usr/src/uts/common/fs/dev)
3. After re-creation of pool/filesystem/child1 with another dataset type (volume instead of filesystem) and accessing this ZFS volume devzvol_lookup -> devname_lookup_func and sdev_cache_update(ddv, &dv, nm, SDEV_CACHE_DELETE); call updates the in-core directory cache ONLY. Therefore all /dev/zvol/*dsk/pool/filesystem/child1 directories hierarchy still exists. So we have dv->sdev_nlink == number_of_child_datasets + 2 for /dev/zvol/*dsk/pool/filesystem/child1 and system panics.