e6b28efccc
dnode_special_close() waits for the refcount of dn_holds to go to zero without holding the dn_mtx. dnode_rele_and_unlock() does the final remove to dn_holds with dn_mtx being held: refs = zfs_refcount_remove(&dn->dn_holds, tag); mutex_exit(&dn->dn_mtx); So, there is a race condition after the remove until dn_mtx is dropped. During that time, dnode_destroy() can get called, which ends up in dnode_dest() calling mutex_destroy() and a panic since the lock is still held. This change adds a condvar to wait for the final dnode_rele_and_unlock() to release the dn_mtx before calling dnode_destroy(). Reviewed-by: Paul Dagnelie <pcd@delphix.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Matthew Ahrens <mahrens@delphix.com> Signed-off-by: John Poduska <jpoduska@datto.com> Closes #7814 Closes #10101 |
||
---|---|---|
.. | ||
os | ||
sys | ||
.gitignore | ||
libnvpair.h | ||
libuutil_common.h | ||
libuutil_impl.h | ||
libuutil.h | ||
libzfs_core.h | ||
libzfs_impl.h | ||
libzfs.h | ||
libzutil.h | ||
Makefile.am | ||
thread_pool.h | ||
zfeature_common.h | ||
zfs_comutil.h | ||
zfs_deleg.h | ||
zfs_fletcher.h | ||
zfs_namecheck.h | ||
zfs_prop.h |