Fix dbuf_stats_hash_table_data race

Dropping DBUF_HASH_MUTEX when walking the hash list is unsafe. The dbuf
can be freed at any time.

Signed-off-by: Chunwei Chen <david.chen@osnexus.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #4846

diff --git a/module/zfs/dbuf_stats.c b/module/zfs/dbuf_stats.c
index afdf828ed54262287939ba02d2d3729f2cb4cbca..6f39f80e563a52f5db627b299c5797b9ad98d6dd 100644 (file)
--- a/module/zfs/dbuf_stats.c
+++ b/module/zfs/dbuf_stats.c
@@ -148,7 +148,6 @@ dbuf_stats_hash_table_data(char *buf, size_t size, void *data)
                }
 
                mutex_enter(&db->db_mtx);
-               mutex_exit(DBUF_HASH_MUTEX(h, dsh->idx));
 
                if (db->db_state != DB_EVICTING) {
                        length = __dbuf_stats_hash_table_data(buf, size, db);
@@ -157,7 +156,6 @@ dbuf_stats_hash_table_data(char *buf, size_t size, void *data)
                }
 
                mutex_exit(&db->db_mtx);
-               mutex_enter(DBUF_HASH_MUTEX(h, dsh->idx));
        }
        mutex_exit(DBUF_HASH_MUTEX(h, dsh->idx));