5056 ZFS deadlock on db_mtx and dn_holds
Reviewed by: Will Andrews <willa@spectralogic.com>
Reviewed by: Matt Ahrens <mahrens@delphix.com>
Reviewed by: George Wilson <george.wilson@delphix.com>
Approved by: Dan McDonald <danmcd@omniti.com>

*** 21,30 ****
--- 21,31 ----
  /*
   * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
   * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
   * Copyright (c) 2013 Martin Matuska. All rights reserved.
   * Copyright (c) 2014 Joyent, Inc. All rights reserved.
+  * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
   */
  
  #include <sys/dmu.h>
  #include <sys/dmu_objset.h>
  #include <sys/dmu_tx.h>
*** 123,150 ****
  
  extern inline dsl_dir_phys_t *dsl_dir_phys(dsl_dir_t *dd);
  
  static uint64_t dsl_dir_space_towrite(dsl_dir_t *dd);
  
- /* ARGSUSED */
  static void
! dsl_dir_evict(dmu_buf_t *db, void *arg)
  {
!         dsl_dir_t *dd = arg;
          dsl_pool_t *dp = dd->dd_pool;
          int t;
  
          for (t = 0; t < TXG_SIZE; t++) {
                  ASSERT(!txg_list_member(&dp->dp_dirty_dirs, dd, t));
                  ASSERT(dd->dd_tempreserved[t] == 0);
                  ASSERT(dd->dd_space_towrite[t] == 0);
          }
  
          if (dd->dd_parent)
!                 dsl_dir_rele(dd->dd_parent, dd);
  
!         spa_close(dd->dd_pool->dp_spa, dd);
  
          /*
           * The props callback list should have been cleaned up by
           * objset_evict().
           */
--- 124,152 ----
  
  extern inline dsl_dir_phys_t *dsl_dir_phys(dsl_dir_t *dd);
  
  static uint64_t dsl_dir_space_towrite(dsl_dir_t *dd);
  
  static void
! dsl_dir_evict(void *dbu)
  {
!         dsl_dir_t *dd = dbu;
          dsl_pool_t *dp = dd->dd_pool;
          int t;
  
+         dd->dd_dbuf = NULL;
+ 
          for (t = 0; t < TXG_SIZE; t++) {
                  ASSERT(!txg_list_member(&dp->dp_dirty_dirs, dd, t));
                  ASSERT(dd->dd_tempreserved[t] == 0);
                  ASSERT(dd->dd_space_towrite[t] == 0);
          }
  
          if (dd->dd_parent)
!                 dsl_dir_async_rele(dd->dd_parent, dd);
  
!         spa_async_close(dd->dd_pool->dp_spa, dd);
  
          /*
           * The props callback list should have been cleaned up by
           * objset_evict().
           */
*** 236,247 ****
                          dd->dd_origin_txg =
                              origin_phys->ds_creation_txg;
                          dmu_buf_rele(origin_bonus, FTAG);
                  }
  
!                 winner = dmu_buf_set_user_ie(dbuf, dd, dsl_dir_evict);
!                 if (winner) {
                          if (dd->dd_parent)
                                  dsl_dir_rele(dd->dd_parent, dd);
                          mutex_destroy(&dd->dd_lock);
                          kmem_free(dd, sizeof (dsl_dir_t));
                          dd = winner;
--- 238,250 ----
                          dd->dd_origin_txg =
                              origin_phys->ds_creation_txg;
                          dmu_buf_rele(origin_bonus, FTAG);
                  }
  
!                 dmu_buf_init_user(&dd->dd_dbu, dsl_dir_evict, &dd->dd_dbuf);
!                 winner = dmu_buf_set_user_ie(dbuf, &dd->dd_dbu);
!                 if (winner != NULL) {
                          if (dd->dd_parent)
                                  dsl_dir_rele(dd->dd_parent, dd);
                          mutex_destroy(&dd->dd_lock);
                          kmem_free(dd, sizeof (dsl_dir_t));
                          dd = winner;
*** 281,290 ****
--- 284,308 ----
          dprintf_dd(dd, "%s\n", "");
          spa_close(dd->dd_pool->dp_spa, tag);
          dmu_buf_rele(dd->dd_dbuf, tag);
  }
  
+ /*
+  * Remove a reference to the given dsl dir that is being asynchronously
+  * released.  Async releases occur from a taskq performing eviction of
+  * dsl datasets and dirs.  This process is identical to a normal release
+  * with the exception of using the async API for releasing the reference on
+  * the spa.
+  */
+ void
+ dsl_dir_async_rele(dsl_dir_t *dd, void *tag)
+ {
+         dprintf_dd(dd, "%s\n", "");
+         spa_async_close(dd->dd_pool->dp_spa, tag);
+         dmu_buf_rele(dd->dd_dbuf, tag);
+ }
+ 
  /* buf must be long enough (MAXNAMELEN + strlen(MOS_DIR_NAME) + 1 should do) */
  void
  dsl_dir_name(dsl_dir_t *dd, char *buf)
  {
          if (dd->dd_parent) {
*** 411,421 ****
          if (err != 0) {
                  return (err);
          }
  
          while (next != NULL) {
!                 dsl_dir_t *child_ds;
                  err = getcomponent(next, buf, &nextnext);
                  if (err != 0)
                          break;
                  ASSERT(next[0] != '\0');
                  if (next[0] == '@')
--- 429,439 ----
          if (err != 0) {
                  return (err);
          }
  
          while (next != NULL) {
!                 dsl_dir_t *child_dd;
                  err = getcomponent(next, buf, &nextnext);
                  if (err != 0)
                          break;
                  ASSERT(next[0] != '\0');
                  if (next[0] == '@')
*** 430,444 ****
                          if (err == ENOENT)
                                  err = 0;
                          break;
                  }
  
!                 err = dsl_dir_hold_obj(dp, ddobj, buf, tag, &child_ds);
                  if (err != 0)
                          break;
                  dsl_dir_rele(dd, tag);
!                 dd = child_ds;
                  next = nextnext;
          }
  
          if (err != 0) {
                  dsl_dir_rele(dd, tag);
--- 448,462 ----
                          if (err == ENOENT)
                                  err = 0;
                          break;
                  }
  
!                 err = dsl_dir_hold_obj(dp, ddobj, buf, tag, &child_dd);
                  if (err != 0)
                          break;
                  dsl_dir_rele(dd, tag);
!                 dd = child_dd;
                  next = nextnext;
          }
  
          if (err != 0) {
                  dsl_dir_rele(dd, tag);