dbuf_free_range() overzealously frees dbufs

When called to free a spill block from a dnode, dbuf_free_range() has a
bug that results in all dbufs for the dnode getting freed.  A variety of
problems may result from this bug, but a common one was a zap lookup
tripping an ASSERT because the zap buffers had been zeroed out.  This
could happen on a dataset with xattr=sa set when extended attributes are
written and removed on a directory concurrently with I/O to files in
that directory.

Signed-off-by: Ned Bass <bass6@llnl.gov>
Fixes #3195
Fixes #3222

module/zfs/dbuf.c

@@ -902,6 +902,8 @@ dbuf_free_range(dnode_t *dn, uint64_t start, uint64_t end, dmu_tx_t *tx)
 			continue;
 		if ((db->db_blkid < start || db->db_blkid > end) && !freespill)
 			continue;
+		if (freespill && db->db_blkid != DMU_SPILL_BLKID)
+			continue;
 
 		/* found a level 0 buffer in the range */
 		mutex_enter(&db->db_mtx);