[LU-11204] mdt_reint_unlink->lu_object_put() crash

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.13.0, Lustre 2.12.4
• Affects Version/s: Lustre 2.12.0
• Assignee: Mikhail Pershin
• Reporter: Oleg Drokin

Description

Seeing these for some time in my testing now, in racer:

[48792.659356] BUG: unable to handle kernel paging request at ffff88008278be60
[48792.659356] IP: [<ffffffffa034f110>] lu_object_put+0x270/0x3c0 [obdclass]
[48792.659356] PGD 23e3067 PUD 33fa01067 PMD 33f9ed067 PTE 800000008278b060
[48792.659356] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[48792.659356] Modules linked in: lustre(OE) ofd(OE) osp(OE) lod(OE) ost(OE) mdt(OE) mdd(OE) mgs(OE) osd_ldiskfs(OE) ldiskfs(OE) lquota(OE) lfsck(OE) obdecho(OE) mgc(OE) lov(OE) mdc(OE) osc(OE) lmv(OE) fid(OE) fld(OE) ptlrpc_gss(OE) ptlrpc(OE) obdclass(OE) ksocklnd(OE) lnet(OE) libcfs(OE) dm_flakey dm_mod loop zfs(PO) zunicode(PO) zlua(PO) zcommon(PO) znvpair(PO) zavl(PO) icp(PO) spl(O) jbd2 mbcache crc_t10dif crct10dif_generic crct10dif_common ata_generic ttm pata_acpi drm_kms_helper i2c_piix4 ata_piix drm virtio_balloon pcspkr serio_raw virtio_console virtio_blk i2c_core libata floppy ip_tables rpcsec_gss_krb5 [last unloaded: libcfs]
[48792.686829] CPU: 1 PID: 21888 Comm: mdt00_002 Kdump: loaded Tainted: P           OE  ------------   3.10.0-7.5-debug #1
[48792.686829] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[48792.686829] task: ffff88009d644c80 ti: ffff8800b93ac000 task.ti: ffff8800b93ac000
[48792.686829] RIP: 0010:[<ffffffffa034f110>]  [<ffffffffa034f110>] lu_object_put+0x270/0x3c0 [obdclass]
[48792.686829] RSP: 0018:ffff8800b93afb38  EFLAGS: 00010246
[48792.686829] RAX: 0000000000000000 RBX: ffff88030ef74160 RCX: 0000000000000002
[48792.686829] RDX: 0000000000000002 RSI: ffffc90007768000 RDI: ffff88008278be68
[48792.686829] RBP: ffff8800b93afb88 R08: 00000000000000cc R09: 000000000000004f
[48792.686829] R10: 0000000000000b01 R11: 00000000003fffff R12: ffff880291d79600
[48792.686829] R13: ffff88008278bea0 R14: ffff88008278be50 R15: ffffc900077a8028
[48792.686829] FS:  0000000000000000(0000) GS:ffff88033da40000(0000) knlGS:0000000000000000
[48792.686829] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[48792.686829] CR2: ffff88008278be60 CR3: 000000024c172000 CR4: 00000000000006e0
[48792.686829] Call Trace:
[48792.686829]  [<ffffffffa0cbbb13>] mdt_reint_unlink+0x7c3/0x1410 [mdt]
[48792.686829]  [<ffffffffa0cbfc10>] mdt_reint_rec+0x80/0x210 [mdt]
[48792.686829]  [<ffffffffa0c9f6ab>] mdt_reint_internal+0x5fb/0x990 [mdt]
[48792.686829]  [<ffffffffa0caa4a7>] mdt_reint+0x67/0x140 [mdt]
[48792.686829]  [<ffffffffa05eca55>] tgt_request_handle+0xaf5/0x1590 [ptlrpc]
[48792.686829]  [<ffffffffa01eaf97>] ? libcfs_debug_msg+0x57/0x80 [libcfs]
[48792.686829]  [<ffffffffa0590eb6>] ptlrpc_server_handle_request+0x256/0xad0 [ptlrpc]
[48792.686829]  [<ffffffff810b9398>] ? __wake_up_common+0x58/0x90
[48792.686829]  [<ffffffff813ccd2b>] ? do_raw_spin_unlock+0x4b/0x90
[48792.686829]  [<ffffffffa0594cae>] ptlrpc_main+0xabe/0x1f80 [ptlrpc]
[48792.686829]  [<ffffffffa05941f0>] ? ptlrpc_register_service+0xeb0/0xeb0 [ptlrpc]
[48792.686829]  [<ffffffff810ae864>] kthread+0xe4/0xf0
[48792.686829]  [<ffffffff810ae780>] ? kthread_create_on_node+0x140/0x140
[48792.686829]  [<ffffffff81783777>] ret_from_fork_nospec_begin+0x21/0x21
[48792.686829]  [<ffffffff810ae780>] ? kthread_create_on_node+0x140/0x140
[48792.686829] Code: a0 31 c0 e8 53 be e9 ff 0f 1f 00 48 8b 03 be 01 00 00 00 48 8b 7d c0 48 8b 40 20 ff 50 18 e9 5a fe ff ff 0f 1f 84 00 00 00 00 00 <49> 8b 46 10 a8 01 0f 84 46 fe ff ff 48 8b 7d b0 31 c9 31 d2 be 
[48792.686829] RIP  [<ffffffffa034f110>] lu_object_put+0x270/0x3c0 [obdclass]
[48792.686829]  RSP <ffff8800b93afb38>
[48792.686829] CR2: ffff88008278be60

Issue Links

• is duplicated by: LU-12741 crash in osd_object_delete at end of sanity
• is related to: LU-9942 Use after free in mdt_mfd_close->lu_object_put