[LU-20078] next_extent panic due to calling osc_extent_tree_dump without object lock held

• Type: Bug
• Resolution: Unresolved
• Priority: Medium
• Severity: 3
• Assignee: Qian Yingjin
• Reporter: Qian Yingjin

Description

The core problems are:

1. osc_extent_tree_dump0() walks the extent rbtree without holding osc_object_lock().
2. LU‑19014 added a new, high‑frequency call to osc_extent_tree_dump() in osc_cache_writeback_range() for the IO_PRIO_DIRTY_EXCEEDED path.
3. next_extent() assumes the passed extent is still in the tree and asserts on RB_EMPTY_NODE(); this is reasonable for normal tree walkers under the object lock, but unsafe for an unlocked debug dump.

if (result == 0 && prio == IO_PRIO_DIRTY_EXCEEDED &&
    !active_ext_check && atomic_read(&obj->oo_nr_ios) &&
    obj->oo_npages > 0) {
    osc_extent_tree_dump(D_CACHE, obj);
    active_ext_check = true;
    GOTO(repeat, result);
}

This panic only happened when the client is enabled debug with cache (debug=+cache) and subsystem_debug with osc (subsystem_debug=+osc).