misc/151111: vnodes leakage during zfs unmount

[Gleb Smirnoff]

The following reply was made to PR kern/151111; it has been noted by GNATS.

From: Gleb Smirnoff <glebius at FreeBSD.org>
To: "Oleg A. Mamontov" <oleg at mamontov.net>
Cc: kib at FreeBSD.org, pjd at FreeBSD.org, freebsd-gnats-submit at FreeBSD.org
Subject: Re: misc/151111: vnodes leakage during zfs unmount
Date: Mon, 18 Oct 2010 16:11:55 +0400

 On Thu, Sep 30, 2010 at 11:56:18AM +0000, Oleg A. Mamontov wrote:
 O> for i in `jot 1000`; do zfs mount tank; printf '%4d   ' $i; sysctl vfs.numvnodes; zfs umount tank; done
 O> ########################
 O>  1   vfs.numvnodes: 708
 O>  2   vfs.numvnodes: 709
 O>  3   vfs.numvnodes: 710
 O>  4   vfs.numvnodes: 711
 O>  5   vfs.numvnodes: 712
 O> 
 O> ..
 O> 
 O> 995   vfs.numvnodes: 1702
 O> 996   vfs.numvnodes: 1703
 O> 997   vfs.numvnodes: 1704
 O> 998   vfs.numvnodes: 1705
 O> 999   vfs.numvnodes: 1706
 O> 1000   vfs.numvnodes: 1707
 
 Here is my lame investigation of the problem. In the zfs_domount() function
 we've got the following code:
 
         /* Grab extra reference. */
         VERIFY(VFS_ROOT(vfsp, LK_EXCLUSIVE, &vp) == 0);
         VOP_UNLOCK(vp, 0);
 
 I suppose this code is expected to put an extra reference on the
 vfsp->mnt_vnodecovered vnode. Do I mistake here? If I don't then this is
 the source of leak.
 
 Debugging shows that zfs_zget(), called subsequently from zfs_root(),
 does not find an existing znode/vnode and allocates a new one, see at the
 end of zfs_zget() function. This vnode gots a reference and is forgotten.
 
 Sorry, if I am being mistaken :)
 
 -- 
 Totus tuus, Glebius.