Files
mirror_zfs/include
John Poduska e6b28efccc Prevent race condition in dnode_dest (#10101)
dnode_special_close() waits for the refcount of dn_holds to go to zero
without holding the dn_mtx. dnode_rele_and_unlock() does the final
remove to dn_holds with dn_mtx being held:

	refs = zfs_refcount_remove(&dn->dn_holds, tag);
	mutex_exit(&dn->dn_mtx);

So, there is a race condition after the remove until dn_mtx is
dropped. During that time, dnode_destroy() can get called, which ends
up in dnode_dest() calling mutex_destroy() and a panic since the lock
is still held.

This change adds a condvar to wait for the final dnode_rele_and_unlock()
to release the dn_mtx before calling dnode_destroy().

Reviewed-by: Paul Dagnelie <pcd@delphix.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Matthew Ahrens <mahrens@delphix.com>
Signed-off-by: John Poduska <jpoduska@datto.com>
Closes #7814
Closes #10101
2020-03-12 10:25:56 -07:00
..
2017-09-19 12:17:29 -07:00
2020-01-10 10:16:58 -08:00
2019-12-11 11:58:37 -08:00
2020-03-04 15:07:11 -08:00
2019-12-19 16:26:07 -08:00
2017-08-09 15:31:08 -07:00
2019-12-05 13:10:29 -08:00
2019-06-24 16:44:01 -07:00
2020-02-11 13:19:12 -08:00