kern/57009: zfs crash in sa_handle_destroy <- zfs_zinactive <- zfs_netbsd_reclaim

[campbell+netbsd%mumble.net@localhost]

>Number:         57009
>Category:       kern
>Synopsis:       zfs crash in sa_handle_destroy <- zfs_zinactive <- zfs_netbsd_reclaim
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 14 08:15:01 +0000 2022
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
Ze ZetBSD Zoundation
>Environment:
NetBSD singbulli 9.99.99 NetBSD 9.99.99 (GENERIC) #174: Thu Sep  8 01:10:04 UTC 2022  root@singbulli:/home/riastradh/netbsd/current/obj.amd64/sys/arch/amd64/compile/GENERIC amd64
>Description:
Machine mostly idle for hours, and then, all of a sudden:

[ 32073.062384] fatal protection fault in supervisor mode
[ 32073.062384] trap type 4 code 0 rip 0xffffffff80fce560 cs 0x8 rflags 0x10246 cr2 0x71a49d0a8000 ilevel 0 rsp 0xffff90108b9afd18
[ 32073.062384] curlwp 0xfffffc4203ec1500 pid 0.9 lowest kstack 0xffff90108b9ab2c0
[ 32073.062384] panic: trap
[ 32073.062384] cpu0: Begin traceback...
[ 32073.062384] vpanic() at netbsd:vpanic+0x183
[ 32073.062384] panic() at netbsd:panic+0x3c
[ 32073.062384] trap() at netbsd:trap+0xb27
[ 32073.062384] --- trap (number 4) ---
[ 32073.062384] _atomic_and_32_nv() at netbsd:_atomic_and_32_nv+0x10
[ 32073.062384] sa_handle_destroy() at zfs:sa_handle_destroy+0x60
[ 32073.062384] zfs_zinactive() at zfs:zfs_zinactive+0x3b
[ 32073.062384] zfs_netbsd_reclaim() at zfs:zfs_netbsd_reclaim+0xd4
[ 32073.062384] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x38
[ 32073.062384] vcache_reclaim() at netbsd:vcache_reclaim+0x1bc
[ 32073.072384] vrecycle() at netbsd:vrecycle+0x14d
[ 32073.072384] vdrain_thread() at netbsd:vdrain_thread+0x68a
[ 32073.072384] cpu0: End traceback...

(gdb) info line *(sa_handle_destroy+0x60)
Line 1363 of "/home/riastradh/netbsd/current/src/sys/../external/cddl/osnet/dist/uts/common/fs/zfs/sa.c" starts at address 0x4d83f <sa_handle_destroy+96>
   and ends at 0x4d849 <sa_handle_destroy+106>.

  1361          dmu_buf_rele(hdl->sa_bonus, NULL);
  1362  
  1363          if (hdl->sa_spill)
  1364                  dmu_buf_rele((dmu_buf_t *)hdl->sa_spill, NULL);
  1365          mutex_exit(&hdl->sa_lock);

(gdb) info line *(zfs_zinactive+0x3b)
Line 596 of "/home/riastradh/netbsd/current/src/sys/../external/cddl/osnet/dist/uts/common/fs/zfs/zfs_znode.c" starts at address 0xa28d6 <zfs_zinactive+59>
   and ends at 0xa28e2 <zfs_zinactive+71>.

   588  void
   589  zfs_znode_dmu_fini(znode_t *zp)
   590  {
   591          ASSERT(MUTEX_HELD(ZFS_OBJ_MUTEX(zp->z_zfsvfs, zp->z_id)) ||
   592              zp->z_unlinked ||
   593              RW_WRITE_HELD(&zp->z_zfsvfs->z_teardown_inactive_lock));
   594  
   595          sa_handle_destroy(zp->z_sa_hdl);
   596          zp->z_sa_hdl = NULL;
   597  }

>How-To-Repeat:
No idea, have never seen it before!
>Fix:
Yes, please!