Problem

mdd_unlink() (mdd_dir.c:2163-2179) and mdd_rename() (:3713-3727) call mdd_trash_param_prep() before mdd_unlink_sanity_check() and before the not-empty check.

prep runs mdd_trash_create() in its own committed transactions to create:

• the per-uid dir

• the pFID stub

• for striped dirs, a full striped stub via mdd_trash_striped_create() (a cross-MDT DTX)

Consequences:

• An rm the user has no permission for, or an rmdir of a non-empty dir, still leaves persistent trash directories behind.

• Nothing garbage-collects them.

• An unprivileged user can drive repeated distributed transactions.

Reproducer

1. Count the objects under .lustre/.ltrash.

1. Attempt a denied rm, then rmdir of a non-empty plain dir and of a non-empty striped dir.

1. Count the objects again.

Expected: the count is unchanged.

Suggested fix

Run prep after the sanity checks, ideally creating the stubs inside the unlink transaction. Otherwise, GC empty stubs.