kern/151942: panic during ls(1) zfs snapshot directory

[Kuang-che Wu]

>Number:         151942
>Category:       kern
>Synopsis:       panic during ls(1) zfs snapshot directory
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 04 17:10:05 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Kuang-che Wu
>Release:        FreeBSD 9.0-CURRENT amd64
>Organization:
>Environment:
System: FreeBSD kcwu.csie.org 9.0-CURRENT FreeBSD 9.0-CURRENT #0: Sun Oct 17 05:01:33 CST 2010 root at kcwu.csie.org:/usr/obj/amd64.amd64/usr/src/sys/DESKTOP amd64


>Description:
	zdata is zpool v15, zfs v4

	$ zpool status -v
	  pool: zdata
	 state: ONLINE
	 scrub: none requested
	config:
	
	        NAME        STATE     READ WRITE CKSUM
	        zdata       ONLINE       0     0     0
	          raidz1    ONLINE       0     0     0
	            ad6p4   ONLINE       0     0     0
	            ad8p4   ONLINE       0     0     0
	            ad10p4  ONLINE       0     0     0
	        cache
	          ad14      ONLINE       0     0     0

	$ zfs list
	NAME                        USED  AVAIL  REFER  MOUNTPOINT
	zdata                       798G  1.87T  31.3G  /zdata
	zdata/backup                138G  1.87T   138G  /zdata/backup
	zdata/files                 149G  1.87T   149G  /zdata/files
	zdata/home                 61.4G  1.87T  25.0G  /home
	zdata/home/kcwu            33.6G  1.87T  26.1G  /home/kcwu
	zdata/foo                   417G  1.87T   114G  /zdata/foo
	zdata/foo/barrrr            117G  1.87T   101G  /zdata/foo/barrrr
	zdata/foo/barr              131G  1.87T   129G  /zdata/foo/barr
	zdata/foo/bar              55.9G  1.87T  50.8G  /zdata/foo/bar

	$ zfs list -t all -r zdata/foo
	NAME                                         USED  AVAIL  REFER  MOUNTPOINT
	zdata/foo                                    417G  1.87T   114G  /zdata/foo
	zdata/foo/barrrr                             117G  1.87T   101G  /zdata/foo/barrrr
	zdata/foo/barrrr at 2010-10-31_01.40           6.89G      -   104G  -
	zdata/foo/barrrr at 2010-10-31_05.30           1.50G      -   101G  -
	zdata/foo/barrrr at 2010-11-01_23.00           1.97G      -   101G  -
	zdata/foo/barrrr at 2010-11-01_23.00            272M      -   100G  -
	zdata/foo/barrrr at 2010-11-02_10.30            503M      -   100G  -
	zdata/foo/barrrr at 2010-11-03_05.50            449M      -   100G  -
	zdata/foo/barrrr at 2010-11-04_06.00               0      -   101G  -
	zdata/foo/barr                               131G  1.87T   129G  /zdata/foo/barr
	zdata/foo/barr at 2010-09-28                   2.41G      -   128G  -
	zdata/foo/bar                               55.9G  1.87T  50.8G  /zdata/foo/bar
	zdata/foo/bar at 2010-09-28                    5.02G      -  48.6G  -
	zdata/foo/bar at 2010-11-03_15.30              88.0M      -  50.7G  -
	zdata/foo/bar at 2010-11-04_13.00                  0      -  50.8G  -

>How-To-Repeat:
	$ ls /zdata/foo/barrrr/.zfs
	kernel panic
	(reproduce rate: 3 times out of 4)

Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 04
fault virtual address   = 0x100
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80715735
stack pointer           = 0x28:0xffffff8072b0e310
frame pointer           = 0x28:0xffffff8072b0e330
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 45332 (ls)
[ thread pid 45332 tid 100320 ]
Stopped at      VOP_LOCK1_APV+0x35:     movq    0x100(%rbx),%rax
db> bt
Tracing pid 45332 tid 100320 td 0xffffff002775e000
VOP_LOCK1_APV() at VOP_LOCK1_APV+0x35
_vn_lock() at _vn_lock+0x47
gfs_file_create() at gfs_file_create+0x65
gfs_dir_create() at gfs_dir_create+0x16
zfsctl_mknode_shares() at zfsctl_mknode_shares+0x43
gfs_dir_lookup() at gfs_dir_lookup+0x1f6
zfsctl_root_lookup() at zfsctl_root_lookup+0x11f
zfsctl_freebsd_root_lookup() at zfsctl_freebsd_root_lookup+0xa4
VOP_LOOKUP_APV() at VOP_LOOKUP_APV+0x40
lookup() at lookup+0x452
namei() at namei+0x53a
kern_statat_vnhook() at kern_statat_vnhook+0x8f
kern_statat() at kern_statat+0x15
lstat() at lstat+0x2a
syscallenter() at syscallenter+0x2cf
syscall() at syscall+0x4b
Xfast_syscall() at Xfast_syscall+0xe2
--- syscall (190, FreeBSD ELF64, lstat), rip = 0x8009941fc, rsp = 0x7fffffffdc38, rbp = 0x800d7a590 ---


	This is very similar to pr kern/150544.
	However, my kernel is -current 2010/10/17 which is already including the patches from kern/150544.
>Fix:



>Release-Note:
>Audit-Trail:
>Unformatted: