3085 zfs diff panics, then panics in a loop on booting

Reviewed by: Matt Ahrens <[email protected]>
Approved by: Richard Lowe <[email protected]>

usr/src/uts/common/fs/zfs/dsl_dataset.c

@@ -3903,6 +3903,10 @@ dsl_dataset_user_release_sync(void *arg1, void *tag, dmu_tx_t *tx)
 	VERIFY(error == 0 || error == ENOENT);
 	zapobj = ds->ds_phys->ds_userrefs_obj;
 	VERIFY(0 == zap_remove(mos, zapobj, ra->htag, tx));
+
+	spa_history_log_internal_ds(ds, "release", tx,
+	    "tag = %s refs now = %lld", ra->htag, (longlong_t)refs);
+
 	if (ds->ds_userrefs == 0 && ds->ds_phys->ds_num_children == 1 &&
 	    DS_IS_DEFER_DESTROY(ds)) {
 		struct dsl_ds_destroyarg dsda = {0};
@@ -3913,9 +3917,6 @@ dsl_dataset_user_release_sync(void *arg1, void *tag, dmu_tx_t *tx)
 		/* We already did the destroy_check */
 		dsl_dataset_destroy_sync(&dsda, tag, tx);
 	}
-
-	spa_history_log_internal_ds(ds, "release", tx,
-	    "tag = %s refs now = %lld", ra->htag, (longlong_t)refs);
 }
 
 static int

usr/src/uts/common/fs/zfs/spa_history.c

@@ -440,8 +440,10 @@ log_internal(nvlist_t *nvl, const char *operation, spa_t *spa,
 	 * If this is part of creating a pool, not everything is
 	 * initialized yet, so don't bother logging the internal events.
 	 */
-	if (tx->tx_txg == TXG_INITIAL)
+	if (tx->tx_txg == TXG_INITIAL) {
+		fnvlist_free(nvl);
 		return;
+	}
 
 	msg = kmem_alloc(vsnprintf(NULL, 0, fmt, adx) + 1, KM_SLEEP);
 	(void) vsprintf(msg, fmt, adx);