.zfs snapshot dir disappears and a crash later on, while umounting

[György Vilmos]

Hi All!
(please keep me on cc)

FreeBSD 7/amd64 stable compiled with GENERIC on May 23 22:22:00 CEST
2009 (csuped sources around that time) on an IBM xSomething.
I have a single disk zfs pool for backup purposes, the fs is
compressed and the stuff goes onto it every night and then snapshotted
once.

I have a nullfs mount from that to a UFS partition, like this:
bkp on /bkp (zfs, local)
bkp at 20090607 on /bkp/.zfs/snapshot/20090607 (zfs, local, noatime, read-
only)
bkp at 20090610 on /bkp/.zfs/snapshot/20090610 (zfs, local, noatime, read-
only)
bkp at 20090609 on /bkp/.zfs/snapshot/20090609 (zfs, local, noatime, read-
only)
bkp at 20090608 on /bkp/.zfs/snapshot/20090608 (zfs, local, noatime, read-
only)
/bkp/hosting on /data/jail/hosting/bkp (nullfs, local)

The strange thing is that while did the above, I lost .zfs, so an ls
wrote this:
ls /bkp/.zfs/snapshot
ls: /bkp/.zfs/snapshot: Bad file descriptor
df also didn't show the snapshot dirs after it, but I could do
snapshots and zfs list -t snapshot showed them, I just couldn't access
them.

Today, I've tried to umount the nullfs mount and the zfs pool to see
whether it helps the situation, but it didn't, I was awarded with a
crashdump.

What I did is:
umount /data/jail/hosting/bkp (went fine, I haven't got back the .zfs
snapshot dir)
then:
zfs export bkp (crash)

The crashdump says:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0xc0
fault code = supervisor write data, page not present
instruction pointer = 0x8:0xffffffff80517925
stack pointer = 0x10:0xffffff80780249d0
frame pointer = 0x10:0xffffff8078024a50
code segment = base 0x0, limit 0xfffff, type 0x1b
  = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 35021 (zpool)
trap number = 12
panic: page fault
cpuid = 1
Uptime: 14d22h20m56s
Physical memory: 4082 MB

bt says:
(kgdb) bt
#0 doadump () at pcpu.h:195
#1 0x0000000000000004 in ?? ()
#2 0xffffffff8050ff29 in boot (howto=260) at /usr/src/sys/kern/
kern_shutdown.c:418
#3 0xffffffff80510332 in panic (fmt=0x104 <Address 0x104 out of
bounds>) at /usr/src/sys/kern/kern_shutdown.c:574
#4 0xffffffff807d5a33 in trap_fatal (frame=0xffffff0020214390,
eva=Variable "eva" is not available.
) at /usr/src/sys/amd64/amd64/trap.c:757
#5 0xffffffff807d5e05 in trap_pfault (frame=0xffffff8078024920,
usermode=0) at /usr/src/sys/amd64/amd64/trap.c:673
#6 0xffffffff807d6744 in trap (frame=0xffffff8078024920) at /usr/src/
sys/amd64/amd64/trap.c:444
#7 0xffffffff807ba96e in calltrap () at /usr/src/sys/amd64/amd64/
exception.S:209
#8 0xffffffff80517925 in _sx_xlock (sx=0xa0, opts=0,
file=0xffffffff80f045e8 "/usr/src/sys/modules/zfs/../../cddl/contrib/
opensolaris/uts/common/fs/zfs/zfs_ctldir.c",
  line=1288) at atomic.h:143
#9 0xffffffff80e97e55 in zfsctl_umount_snapshots (vfsp=Variable
"vfsp" is not available.
) at /usr/src/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/
common/fs/zfs/zfs_ctldir.c:1288
#10 0xffffffff80ea3560 in zfs_umount (vfsp=0xffffff00048b7380,
fflag=0, td=Variable "td" is not available.
) at /usr/src/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/
common/fs/zfs/zfs_vfsops.c:1003
#11 0xffffffff8058e1a7 in dounmount (mp=0xffffff00048b7380, flags=0,
td=0xffffff0020214390) at /usr/src/sys/kern/vfs_mount.c:1290
#12 0xffffffff8058e975 in unmount (td=0xffffff0020214390,
uap=0xffffff8078024bf0) at /usr/src/sys/kern/vfs_mount.c:1186
#13 0xffffffff807d6087 in syscall (frame=0xffffff8078024c80) at /usr/
src/sys/amd64/amd64/trap.c:900
#14 0xffffffff807bab7b in Xfast_syscall () at /usr/src/sys/amd64/amd64/
exception.S:330
#15 0x000000080102e5cc in ?? ()
Previous frame inner to this frame (corrupt stack?)

I have the dump, if any further info could help.

Thank you in advance.