[LU-2724] Null pointer dereference in lprocfs_rd_import()

• Type: Bug
• Resolution: Fixed
• Priority: Blocker
• Fix Version/s: Lustre 2.4.0
• Affects Version/s: Lustre 2.4.0
• Labels: LB
• Severity: 3
• Assignee: John Hammond
• Reporter: Li Wei (Inactive)

Description

Looks like obd_svc_stats was null when I cat /proc/fs/lustre/mgc/MGC192.168.56.101@tcp/import:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [<ffffffffa083e50e>] lprocfs_rd_import+0x38e/0x6e0 [obdclass]
PGD 7a329067 PUD 7a32a067 PMD 0 
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
last sysfs file: /sys/devices/system/cpu/possible
CPU 0 
Modules linked in: lustre(U) ofd(U) osp(U) lod(U) ost(U) mdt(U) osd_ldiskfs(U) fsfilt_ldiskfs(U) ldiskfs(U) mdd(U) mgs(U) lquota(U) obdecho(U) mgc(U) lov(U) osc(U) mdc(U) lmv(U) fid(U) fld(U) ptlrpc(U) obdclass(U) lvfs(U) ksocklnd(U) lnet(U) libcfs(U) exportfs jbd sha512_generic sha256_generic ipv6 zfs(P)(U) zcommon(P)(U) znvpair(P)(U) zavl(P)(U) zunicode(P)(U) spl(U) zlib_deflate ppdev parport_pc parport e1000 i2c_piix4 i2c_core snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc sg ext4 mbcache jbd2 sd_mod crc_t10dif sr_mod cdrom ahci pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: libcfs]

Pid: 3942, comm: cat Tainted: P           ---------------    2.6.32-279.5.1.el6.4d65293 #1 innotek GmbH VirtualBox/VirtualBox
RIP: 0010:[<ffffffffa083e50e>]  [<ffffffffa083e50e>] lprocfs_rd_import+0x38e/0x6e0 [obdclass]
RSP: 0018:ffff88007a325d98  EFLAGS: 00010246
RAX: ffff88001dc5c0b8 RBX: ffff88007910f800 RCX: 0000000000000001
RDX: ffff88007a325dd8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88007a325e38 R08: 00000000fffffffb R09: 00000000fffffffe
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000170 R14: 0000000000000000 R15: 0000000000001000
FS:  00007f9913c27700(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000007a327000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process cat (pid: 3942, threadinfo ffff88007a324000, task ffff880022d62040)
Stack:
 ffff880000000000 0000000000000000 ffff880000000001 ffff88007910f800
<d> ffff88001dc5c5e0 ffff88007910fa68 ffff88001dc5c0b8 ffff88007a317000
<d> 0000000000000000 ffffffff81abf940 0000000000000000 fffffffffffffffb
Call Trace:
 [<ffffffff8115c52a>] ? alloc_pages_current+0xaa/0x110
 [<ffffffffa083a263>] lprocfs_fops_read+0xf3/0x1f0 [obdclass]
 [<ffffffff811e0f5e>] proc_reg_read+0x7e/0xc0
 [<ffffffff8117bc25>] vfs_read+0xb5/0x1a0
 [<ffffffff810d6cb2>] ? audit_syscall_entry+0x272/0x2a0
 [<ffffffff8117bd61>] sys_read+0x51/0x90
 [<ffffffff8100b0f2>] system_call_fastpath+0x16/0x1b
Code: f6 31 c0 44 89 34 24 e8 71 ef a3 e0 46 8d 2c 28 48 8b 45 88 66 ff 00 66 66 90 48 8b 45 90 48 8d 55 a0 31 f6 48 8b b8 e8 19 00 00 <4c> 8b 67 10 e8 09 f8 ff ff 48 8b 4d a0 48 85 c9 0f 85 cc 01 00 
RIP  [<ffffffffa083e50e>] lprocfs_rd_import+0x38e/0x6e0 [obdclass]
 RSP <ffff88007a325d98>
CR2: 0000000000000010
---[ end trace 130c592d1674d0c5 ]---
Kernel panic - not syncing: Fatal exception

The line of code in question was:

        header = &obd->obd_svc_stats->ls_cnt_header[PTLRPC_REQWAIT_CNTR];

Comments

[Peter Jones]

Landed for 2.4

[John Hammond]

Please see http://review.whamcloud.com/5234.

[Li Wei (Inactive)]

It was master (ca461f0 LU-1282 lprocfs: reduce lprocfs stats memory use) plus my local changes, which do not seem to cause the issue.