Bug #8377

Panic in bookmark deletion

Added by Serapheim Dimitropoulos about 1 year ago. Updated about 1 month ago.

Status:ClosedStart date:2017-06-12
Priority:NormalDue date:
Assignee:Serapheim Dimitropoulos% Done:

100%

Category:zfs - Zettabyte File System
Target version:-
Difficulty:Medium Tags:needs-triage

Description

The problem is that when dsl_bookmark_destroy_check() is executed from open context (the pre-check), it fills in dbda_success based on the existence of the bookmark.
But the bookmark (or containing filesystem as in this case) can be destroyed before we get to syncing context. When we re-run dsl_bookmark_destroy_check() in syncing
context, it will not add the deleted bookmark to dbda_success, intending for dsl_bookmark_destroy_sync() to not process it. But because the bookmark is still in dbda_success
from the open-context call, we do try to destroy it.

The fix is that dsl_bookmark_destroy_check() should not modify dbda_success when called from open context.

History

#1 Updated by Electric Monk 12 months ago

  • % Done changed from 0 to 100
  • Status changed from New to Closed

git commit 42418f9e73f0d007aa87675ecc206c26fc8e073e

commit  42418f9e73f0d007aa87675ecc206c26fc8e073e
Author: Matthew Ahrens <mahrens@delphix.com>
Date:   2017-06-29T23:10:42.000Z

    8377 Panic in bookmark deletion
    Reviewed by: Paul Dagnelie <pcd@delphix.com>
    Reviewed by: Pavel Zakharov <pavel.zakharov@delphix.com>
    Reviewed by: George Wilson <george.wilson@delphix.com>
    Approved by: Robert Mustacchi <rm@joyent.com>

#2 Updated by Serapheim Dimitropoulos about 1 month ago

For completeness, here is the stack of the failure for this issue:

::status
...
panic message: assertion failed: dsl_bookmark_hold_ds(dp, nvpair_name(pair), &ds, ((char *)__func__), &shortname) 0 (0x2 0x0), file: ../../common/fs/zfs/dsl_bookmark.c, line: 903
dump content: kernel pages only
$C
ffffff000cf598c0 vpanic()
ffffff000cf59950 strlog()
ffffff000cf599c0 dsl_bookmark_destroy_sync+0x12f(ffffff000db74b50, ffffff03d9b24c80)
ffffff000cf59a00 dsl_sync_task_sync+0x10a(ffffff000db74a60, ffffff03d9b24c80)
ffffff000cf59a90 dsl_pool_sync+0x26b(ffffff03d314f000, 237f)
ffffff000cf59b70 spa_sync+0x3ff(ffffff03317f4000, 237f)
ffffff000cf59c20 txg_sync_thread+0x21f(ffffff03d314f000)
ffffff000cf59c30 thread_start+8()

Also available in: Atom