[LU-4510] Oops (use after free) in osp_prealloc_next_seq_seq_show

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Affects Version/s: Lustre 2.6.0
• Severity: 3
• Assignee: WC Triage
• Reporter: Oleg Drokin

Description

Apparently recent seq_file patch a97e4898ad9e0b65f457b01bdfa954f7d7cd272d from http://review.whamcloud.com/8029
introduced this issue that I now hit sporadically on my test rig after mds shutdown:

<1>[13732.075265] BUG: unable to handle kernel paging request at ffff8800812c8f48
<1>[13732.075983] IP: [<ffffffffa07cef20>] osp_prealloc_next_seq_seq_show+0x70/0x90 [osp]
<4>[13732.077095] PGD 1a26063 PUD 501067 PMD 50b067 PTE 80000000812c8060
<4>[13732.077769] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
<4>[13732.078942] last sysfs file: /sys/devices/system/cpu/possible
<4>[13732.079099] CPU 7 
<4>[13732.079099] Modules linked in: lustre ofd osp lod ost mdt mdd mgs nodemap osd_ldiskfs ldiskfs lquota lfsck obdecho mgc lov osc mdc lmv fid fld ptlrpc obdclass ksocklnd lnet libcfs exportfs jbd sha512_generic sha256_generic ext4 jbd2 mbcache virtio_balloon virtio_console i2c_piix4 i2c_core virtio_blk virtio_net virtio_pci virtio_ring virtio pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod nfs lockd fscache auth_rpcgss nfs_acl sunrpc be2iscsi bnx2i cnic uio ipv6 cxgb3i libcxgbi cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi [last unloaded: libcfs]
<4>[13732.079099] 
<4>[13732.079099] Pid: 13335, comm: lctl Not tainted 2.6.32-rhe6.4-debug2 #1 Red Hat KVM
<4>[13732.079099] RIP: 0010:[<ffffffffa07cef20>]  [<ffffffffa07cef20>] osp_prealloc_next_seq_seq_show+0x70/0x90 [osp]
<4>[13732.079099] RSP: 0018:ffff8800902ade18  EFLAGS: 00010286
<4>[13732.079099] RAX: ffff8800812c8f30 RBX: ffff880089c80f08 RCX: 0000000000000000
<4>[13732.079099] RDX: ffffffffa07d6080 RSI: 0000000000000001 RDI: ffff880073066f30
<4>[13732.079099] RBP: ffff8800902ade18 R08: 0000000000000001 R09: 0000000000000000
<4>[13732.079099] R10: ffff880063130000 R11: 0000000000001000 R12: ffff880073066f30
<4>[13732.079099] R13: 0000000000000001 R14: 0000000000d709f0 R15: ffff8800902ade60
<4>[13732.079099] FS:  00007fc4f2a27700(0000) GS:ffff8800063c0000(0000) knlGS:0000000000000000
<4>[13732.079099] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[13732.079099] CR2: ffff8800812c8f48 CR3: 00000000815c6000 CR4: 00000000000006e0
<4>[13732.079099] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<4>[13732.079099] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>[13732.079099] Process lctl (pid: 13335, threadinfo ffff8800902ac000, task ffff8800547660c0)
<4>[13732.079099] Stack:
<4>[13732.079099]  ffff8800902ade98 ffffffff811a5bd8 000000000007cac7 0000000000d709f0
<4>[13732.079099] <d> ffff880073066f68 ffff8800902adf48 0000000000001000 0000000000000000
<4>[13732.079099] <d> ffff88007cac7000 0000000000000000 ffff880089c80f08 ffff88008fbf3f30
<4>[13732.079099] Call Trace:
<4>[13732.079099]  [<ffffffff811a5bd8>] seq_read+0xf8/0x420
<4>[13732.079099]  [<ffffffff811a5ae0>] ? seq_read+0x0/0x420
<4>[13732.079099]  [<ffffffff811eb015>] proc_reg_read+0x85/0xc0
<4>[13732.079099]  [<ffffffff81181f45>] vfs_read+0xb5/0x1a0
<4>[13732.079099]  [<ffffffff81182081>] sys_read+0x51/0x90
<4>[13732.079099]  [<ffffffff8100b0b2>] system_call_fastpath+0x16/0x1b
<4>[13732.079099] Code: c7 05 79 3f 01 00 00 00 04 00 e8 7c eb 2e 00 48 c7 c7 60 2e 7e a0 e8 50 ef 2d 00 31 c0 c9 c3 48 8b 80 18 01 00 00 48 85 c0 74 f0 <48> 8b 50 18 48 c7 c6 ce 80 7d a0 31 c0 e8 6e 6a 9d e0 c9 c3 66 

Issue Links

• is related to: LU-4513 sanity test_220: prealloc_last_id: Found no match
• is related to: LU-4513 sanity test_220: prealloc_last_id: Found no match
• is related to: LU-3319 Adapt to 3.10 upstream kernel proc_dir_entry change