Undirty removed spill blocks.

If a spill block's dbuf hasn't yet been written when a the spill block
is removed, the unwritten version will still be written.  This patch
undirties the dbuf in this case to prevent it to be written.

The most common case in which this could happen is when xattr=sa is being
used and a long xattr is immediately replaced by a short xattr as in:

	setfattr -n user.test -v very_very_very..._long_value  <file>
	setfattr -n user.test -v short_value  <file>

The first value must be sufficiently long that a spill block is generated
and the second value must be short enough to not require a spill block.
In practice, this would typically happen due to internal xattr operations
as a result of setting acltype=posixacl.

module/zfs/dbuf.c

@@ -876,6 +876,21 @@ dbuf_free_range(dnode_t *dn, uint64_t start, uint64_t end, dmu_tx_t *tx)
 
 	mutex_enter(&dn->dn_dbufs_mtx);
 	if (start >= dn->dn_unlisted_l0_blkid * dn->dn_datablksz) {
+		/*
+		 * Don't re-write a spill block when it's being removed.
+		 */
+		if (start == DMU_SPILL_BLKID && end == DMU_SPILL_BLKID) {
+			dmu_buf_impl_t *xdb, *xdb_next;
+
+			for (xdb = list_head(&dn->dn_dbufs); xdb != NULL; xdb = xdb_next) {
+				xdb_next = list_next(&dn->dn_dbufs, xdb);
+				if (xdb->db_blkid == DMU_SPILL_BLKID) {
+					(void) dbuf_undirty(xdb, tx);
+					break;
+				}
+			}
+		}
+
 		/* There can't be any dbufs in this range; no need to search. */
 		mutex_exit(&dn->dn_dbufs_mtx);
 		return;