From 0f90a797dd442402dfb181f2fe25caa5a983452b Mon Sep 17 00:00:00 2001 From: Brian Behlendorf Date: Tue, 3 Mar 2026 09:05:34 -0800 Subject: [PATCH] Fix vdev_rebuild_range() tx commit The spa_sync thread waits on ->spa_txg_zio and will set ZIO_WAIT_DONE before running the sync tasks. The dmu_tx_commit() call must be done after we add the child zio to the ->spa_txg_zio parent otherwise its possible the child is added after txg_sync has waited. Reviewed-by: Alexander Motin Signed-off-by: Brian Behlendorf Closes #18276 --- module/zfs/vdev_rebuild.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/module/zfs/vdev_rebuild.c b/module/zfs/vdev_rebuild.c index 68a953780..bb75bcb49 100644 --- a/module/zfs/vdev_rebuild.c +++ b/module/zfs/vdev_rebuild.c @@ -616,7 +616,6 @@ vdev_rebuild_range(vdev_rebuild_t *vr, uint64_t start, uint64_t size) return (SET_ERROR(EINTR)); } mutex_exit(&vd->vdev_rebuild_lock); - dmu_tx_commit(tx); vr->vr_scan_offset[txg & TXG_MASK] = start + size; vr->vr_pass_bytes_issued += size; @@ -626,6 +625,9 @@ vdev_rebuild_range(vdev_rebuild_t *vr, uint64_t start, uint64_t size) abd_alloc(psize, B_FALSE), psize, vdev_rebuild_cb, vr, ZIO_PRIORITY_REBUILD, ZIO_FLAG_RAW | ZIO_FLAG_CANFAIL | ZIO_FLAG_RESILVER, NULL)); + /* vdev_rebuild_cb releases SCL_STATE_ALL */ + + dmu_tx_commit(tx); return (0); }