[LU-15986] Race condition between _debug_req() and ptlrpc_req_drop_rs()

• Type: Bug
• Resolution: Fixed
• Priority: Critical
• Fix Version/s: Lustre 2.16.0, Lustre 2.15.2
• Severity: 3
• Assignee: Feng Lei
• Reporter: Feng Lei

Description

Two execution paths about req->rq_repmsg:

Path 1 happens when server receives a resent request:

 ptlrpc_main()-> ptlrpc_server_handle_req_in()->ptlrpc_server_request_add()->ptlrpc_server_check_resend_in_progress()->_debug_req(tmp)

Path 2 happens when server sends reply and drop the rs:

 ptlrpc_server_finish_request()->ptlrpc_server_drop_request()->ptlrpc_server_free_request()->ptlrpc_req_drop_rs()

 req->rq_repmsg is not protected well in ptlrpc_req_drop_rs()