Reproducible ZFS-related panic

If you import and export more than one zpool FreeBSD will panic during
shutdown. This bug is present in both RELENG_7 and RELENG_7_0 (I have
not tested CURRENT).

kgdb output:

Syncing disks, vnodes remaining...2 1 0 0 done
All buffers synced.
vput: negative ref count
0xc2ad1aa0: tag ufs, type VDIR
    usecount 0, writecount 0, refcount 2 mountedhere 0
    flags (VV_ROOT)
 VI_LOCKed    v_object 0xc1030174 ref 0 pages 1
     lock type ufs: EXCL (count 1) by thread 0xc2960000 (pid 1)
        ino 2, on dev ad0s1a
panic: vput: negative ref cnt
KDB: stack backtrace:
db_trace_self_wrapper(c086ad8a,d3b19b68,c06265ba,c0868fd5,c08e9ca0,...)
at db_trace_self_wrapper+0x26
kdb_backtrace(c0868fd5,c08e9ca0,c086f57a,d3b19b74,d3b19b74,...) at
kdb_backtrace+0x29
panic(c086f57a,c0855555,c086f561,c2ad1aa0,d3b19b90,...) at panic+0xaa
vput(c2ad1aa0,2,d3b19bf0,c2960000,c086eedd,...) at vput+0xdb
dounmount(c2ba6d0c,80000,c2960000,0,0,...) at dounmount+0x49f
vfs_unmountall(c0868ebb,0,c2967000,8,d3b19c50,...) at
vfs_unmountall+0x33
boot(c2960000,8,1,c295e000,c2960000,...) at boot+0x3e3
reboot(c2960000,d3b19cfc,4,c086b882,56,...) at reboot+0x66
syscall(d3b19d38) at syscall+0x33a
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (55, FreeBSD ELF32, reboot), eip = 0x8050903, esp =
0xbfbfe90c, ebp = 0xbfbfe9d8 ---
Uptime: 2m42s
Physical memory: 503 MB
Dumping 39 MB: 24 8


Run this script and then reboot the computer to trigger the panic:

dd if=/dev/zero of=/usr/_disk1 bs=1m count=80
dd if=/dev/zero of=/usr/_disk2 bs=1m count=80
mdconfig -f /usr/_disk1 -u 1
mdconfig -f /usr/_disk2 -u 2
/etc/rc.d/zfs forcestart
zpool create tank1 md1
zpool create tank2 md2
sleep 2
touch /tank1/testfile
touch /tank2/testfile
sleep 2
zpool export tank2
zpool export tank1
sleep 10
zpool import tank1
zpool import tank2
sleep 2
touch /tank1/testfile
touch /tank2/testfile
sleep 2
zpool export tank2
zpool export tank1
/etc/rc.d/zfs forcestop
sleep 2
mdconfig -d -u 1
mdconfig -d -u 2
rm /usr/_disk1
rm /usr/_disk2

/Daniel Eriksson