- Add a BO_NEEDSGIANT flag to the bufobj. This flag forces all child

buffers to go on the buf daemon's DIRTYGIANT queue.
 - Set BO_NEEDSGIANT on ffs's devvp since the ffs_copyonwrite handler
   runs in the context of the buf daemon and may require Giant.

sys/kern/vfs_subr.c

@@ -1446,7 +1446,8 @@ bgetvp(struct vnode *vp, struct buf *bp)
 
 	ASSERT_VI_LOCKED(vp, "bgetvp");
 	vholdl(vp);
-	if (VFS_NEEDSGIANT(vp->v_mount))
+	if (VFS_NEEDSGIANT(vp->v_mount) ||
+	    vp->v_bufobj.bo_flag & BO_NEEDSGIANT)
 		bp->b_flags |= B_NEEDSGIANT;
 	bp->b_vp = vp;
 	bp->b_bufobj = &vp->v_bufobj;

sys/sys/bufobj.h

@@ -106,6 +106,7 @@ struct bufobj {
  */
 #define	BO_ONWORKLST	(1 << 0)	/* On syncer work-list */
 #define	BO_WWAIT	(1 << 1)	/* Wait for output to complete */
+#define	BO_NEEDSGIANT	(1 << 2)	/* Require giant for child buffers. */
 
 #define	BO_LOCK(bo) \
 	do { \

sys/ufs/ffs/ffs_vfsops.c

@@ -831,7 +831,13 @@ ffs_mountfs(devvp, mp, td)
 	(void) ufs_extattr_autostart(mp, td);
 #endif /* !UFS_EXTATTR_AUTOSTART */
 #endif /* !UFS_EXTATTR */
-#ifndef QUOTA
+#ifdef QUOTA
+	/*
+	 * Our bufobj must require giant for snapshots when quotas are
+	 * enabled.
+	 */
+	devvp->v_bufobj.bo_flags |= BO_NEEDSGIANT;
+#else
 	mp->mnt_kern_flag |= MNTK_MPSAFE;
 #endif
 	return (0);