[Bug 233277] Panic when receiving incremental ZFS send (solaris assert: db->db_buf == ((void *)0))

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=233277

--- Comment #3 from Alexander Motin <mav at FreeBSD.org> ---
I've just reproduced it in clean environment.  I suspect it is related to my
recent patch fixing spill block loss on block size change
(https://svnweb.freebsd.org/base?view=revision&revision=340096).

Here is the reproduction scenario:

# zfs create ssd/zzz
# dd if=/dev/zero of=/ssd/zzz/f bs=4k count=1
1+0 records in
1+0 records out
4096 bytes transferred in 0.001220 secs (3356604 bytes/sec)
# dd if=/dev/random of=/ssd/zzz/f bs=4 count=1 conv=notrunc
1+0 records in
1+0 records out
4 bytes transferred in 0.002598 secs (1540 bytes/sec)
# zfs snapshot ssd/zzz at a
# zfs send -e ssd/zzz at a |zfs receive ssd/xxx
# dd if=/dev/zero of=/ssd/zzz/f bs=16k count=1 conv=notrunc
1+0 records in
1+0 records out
16384 bytes transferred in 0.002887 secs (5674227 bytes/sec)
# dd if=/dev/random of=/ssd/zzz/f bs=4 count=1 conv=notrunc
1+0 records in
1+0 records out
4 bytes transferred in 0.000199 secs (20141 bytes/sec)
# zfs snapshot ssd/zzz at b
# zfs send -e -i a ssd/zzz at b | zfs receive ssd/xxx

panic: solaris assert: db->db_buf == ((void *)0) (0xfffff80116233c00 == 0x0),
file:
/sources/FreeBSD/head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dbuf.c,
line: 1097
cpuid = 44
time = 1542744219
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe010bc1f800
vpanic() at vpanic+0x1a3/frame 0xfffffe010bc1f860
panic() at panic+0x43/frame 0xfffffe010bc1f8c0
assfail3() at assfail3+0x2c/frame 0xfffffe010bc1f8e0
dmu_buf_will_fill() at dmu_buf_will_fill+0x24b/frame 0xfffffe010bc1f920
dmu_buf_write_embedded() at dmu_buf_write_embedded+0xe0/frame
0xfffffe010bc1f970
dmu_write_embedded() at dmu_write_embedded+0xea/frame 0xfffffe010bc1f9d0
receive_writer_thread() at receive_writer_thread+0x513/frame 0xfffffe010bc1fa70
fork_exit() at fork_exit+0x84/frame 0xfffffe010bc1fab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe010bc1fab0

-- 
You are receiving this mail because:
You are the assignee for the bug.