Bug #8075
Attempting to destroy ZFS filesystem and create ZFS volume with the same name caused system panic
50%
Description
Steps to reproduce:
#!/bin/ksh TESTPOOL=rpool TESTFS=fs TESTVOL=vol zfs create $TESTPOOL/$TESTFS zfs create -V 1M $TESTPOOL/$TESTFS/$TESTVOL stat /dev/zvol/rdsk/$TESTPOOL/$TESTFS/$TESTVOL zfs destroy -r $TESTPOOL/$TESTFS zfs create -V 1M $TESTPOOL/$TESTFS stat /dev/zvol/rdsk/$TESTPOOL/$TESTFS
Panic info:
> ::panicinfo [1/31] cpu 0 thread ffffff040a987400 message assertion failed: dv->sdev_nlink == 1, file: ../../common/fs/dev/sdev_subr.c, line: 3133 rdi fffffffffbf639e0 rsi ffffff0011af2470 rdx fffffffffb9c1870 rcx c3d r8 fffffffffbe6a035 r9 0 rax ffffff0011af2490 rbx ffffff0419b4a300 rbp ffffff0011af24d0 r10 1 r11 1 r12 ffffff04133a4820 r13 ffffff04133a4848 r14 ffffff04071c0c68 r15 ffffff03ed376580 fsbase 0 gsbase fffffffffbc476c0 ds 4b es 4b fs 0 gs 1c3 trapno 0 err 0 rip fffffffffb86d500 cs 30 rflags 282 rsp ffffff0011af2468 ss 38 gdt_hi 0 gdt_lo e00001ef idt_hi 0 idt_lo d0000fff ldt 0 task 70 cr0 80050033 cr2 807b098 cr3 1fffa0000 cr4 406f8 > ::stack vpanic() 0xfffffffffbe18678() devname_inactive_func+0x99(ffffff0419b4a300, ffffff04071c0c68, 0) sdev_inactive+0x1b(ffffff0419b4a300, ffffff04071c0c68, 0) fop_inactive+0x76(ffffff0419b4a300, ffffff04071c0c68, 0) vn_rele+0x82(ffffff0419b4a300) devname_lookup_func+0x701(ffffff0412e615a0, ffffff0011af29b0, ffffff0011af29a8, ffffff04071c0c68, fffffffffb9ba460, 8) devzvol_lookup+0x2ae(ffffff0412e49800, ffffff0011af29b0, ffffff0011af29a8, ffffff0011af2c00, 0, ffffff03e9fee800) fop_lookup+0xa2(ffffff0412e49800, ffffff0011af29b0, ffffff0011af29a8, ffffff0011af2c00, 0, ffffff03e9fee800) lookuppnvp+0x230(ffffff0011af2c00, 0, 0, 0, ffffff0011af2df8, ffffff03e9fee800) lookuppnatcred+0x15e(ffffff0011af2c00, 0, 0, 0, ffffff0011af2df8, 0) lookupnameatcred+0xdd(8047d0d, 0, 0, 0, ffffff0011af2df8, 0) lookupnameat+0x39(8047d0d, 0, 0, 0, ffffff0011af2df8, 0) cstatat_getvp+0x107(ffd19553, 8047d0d, 0, ffffff0011af2df8, ffffff0011af2df0) cstatat64_32+0x6f(ffd19553, 8047d0d, 8047ae8, 1000, 0) fstatat64_32+0x42(ffd19553, 8047d0d, 8047ae8, 1000) lstat64_32+0x25(8047d0d, 8047ae8) sys_syscall32+0x1f7()
1. In case of ZFS filesystem with nested child datasets we have /dev/zvol/*dsk
directories hierarchy /dev/zvol/*dsk/pool/filesystem/child1/child2/child3
2. When pool/filesystem/child1
filesystem and its children datasets are destroyed, all /dev/zvol/*dsk
directories hierarchy for pool/filesystem/child1
and sdev cache still exists (by design of usr/src/uts/common/fs/dev)
3. After re-creation of pool/filesystem/child1
with another dataset type (volume instead of filesystem) and accessing this ZFS volume devzvol_lookup -> devname_lookup_func
and sdev_cache_update(ddv, &dv, nm, SDEV_CACHE_DELETE);
call updates the in-core directory cache ONLY. Therefore all /dev/zvol/*dsk/pool/filesystem/child1
directories hierarchy still exists. So we have dv->sdev_nlink == number_of_child_datasets + 2
for /dev/zvol/*dsk/pool/filesystem/child1
and system panics.
Related issues
Updated by Yuri Pankov almost 4 years ago
- Has duplicate Bug #7291: Attempting to destroy ZFS filesystem and create ZFS volume with the same name caused system panic added
Updated by Alex Deiter almost 4 years ago
Please review my pull request: https://github.com/illumos/illumos-gate/pull/22
Updated by Yuri Pankov almost 4 years ago
- Has duplicate deleted (Bug #7291: Attempting to destroy ZFS filesystem and create ZFS volume with the same name caused system panic)
Updated by Yuri Pankov almost 4 years ago
- Is duplicate of Bug #7291: Attempting to destroy ZFS filesystem and create ZFS volume with the same name caused system panic added