On 2/3/15 12:15 , Justin T. Gibbs wrote: > My belief is that the race is eliminated from the normal dataset release > path. What the previous patch doesn’t guard against is a dbuf_clear() > causing an immediate eviction of the dataset’s bonus buffer. I need to trace > through the code further, but I believe this race is between a property > callback and dbuf_clear() being called when the dataset is destroyed. Can > you confirm that the crashing systems are doing a lot of dataset destroy > operations?
The system in this case wasn't doing much in terms of explicit destroys. It was doing dataset creations and in this case, we were renaming a dataset. I'm not sure if renaming would cause us to enter the same paths as destroy. Robert >> On Feb 3, 2015, at 12:49 PM, Robert Mustacchi <[email protected]> wrote: >> >> Hi, >> >> We've seen another variant of 5531 now pop up on our systems. >> Specifically we're seeing dmu_buf_rele() get passed a NULL dmu_buf_t *. >> It seems like we've only narrowed the race from 5531, but didn't manage >> to kill it entirely. >> >> Specifically we're seeing the following stack trace: >> >>> $c >> mutex_enter+0xb() >> dmu_buf_rele+0x15(0, fffffffff7e00720) >> dsl_dataset_rele+0x19(ffffff0340e250c0, fffffffff7e00720) >> dsl_prop_notify_all_cb+0xbb(ffffff0254120900, ffffff02d13aa9c0, 0) >> dmu_objset_find_dp+0x108(ffffff0254120900, 366, fffffffff7d742f0, 0, 2) >> dsl_prop_notify_all+0x28(ffffff02654dbac0) >> dsl_dir_rename_sync+0x2d1(ffffff00111a9b40, ffffff0260db3680) >> dsl_sync_task_sync+0x10a(ffffff00111a9a60, ffffff0260db3680) >> dsl_pool_sync+0x28b(ffffff0254120900, 1558) >> spa_sync+0x27e(ffffff0254d3b000, 1558) >> txg_sync_thread+0x227(ffffff0254120900) >> thread_start+8() >> >> >> The dump is available at >> https://us-east.manta.joyent.com/Joyent_Dev/public/bugs/OS-3788/vmdump.0. I'd >> appreciate if anyone had some time to look at this. >> >> Thanks, >> Robert >> > _______________________________________________ developer mailing list [email protected] http://lists.open-zfs.org/mailman/listinfo/developer
