ZFS lookup of ".." below .zfs returns itself (same vnode as dvp)

[Rick Macklem]

Hi,

I've been working on a panic/crash that happens when a NFSv4
mount from a client tries to lookup ".." below a .zfs directory.

The thread is over on freebsd-current:
http://docs.FreeBSD.org/cgi/mid.cgi?CAE-mSOLA2J6KteFM-NH9Lb9TfX3rykckkMjguZMQFg4oLx-mWQ

It seems that, for this case, the lookup of ".." returns itself.
This causes a panic() when the code in zfs_lookup() tries to re-lock
the directory, since it is already returned locked. A one line
change at line #1451 in zfs_vnops.c to
   if ((cnp->cn_flags & ISDOTDOT) && *vpp != dvp)
stops the panics, but because I know nothing about ZFS, I don't
know where to take this. Normally, I would only expect this at
the root of a file system, but VV_ROOT isn't set for this vnode.

>From reading a few comments, it seems that ZFS returns the snapshot
directory for this case. I can vaguely see that .zfs is somehow "special".

Knowing nothing about ZFS, maybe someone can help with answers to
a few questions and/or suggestions w.r.t. how the NFS server should
handle this case.

Is .zfs considered a snapshot directory or is the snapshot directory
below .zfs?

I see lookups for the name "snapshot". Is that the actual name of
this snapshot directory and is it always the same?

Are these meant to look like normal mount points. If not, I can't
see how things like getcwd() would work once cd'd to below it?

Any help with understanding this would be appreciated, rick
ps: After the one line patch, the server doesn't panic, but it
    seems to return an empty directory when the "ls /.zfs/shares/"
    is done by Sergey.