[LU-5145] kernel slab data memory coruption on MDS due to a file with truncated link extended attribute

• Type: Bug
• Resolution: Duplicate
• Priority: Critical
• Affects Version/s: Lustre 2.4.3
• Severity: 3
• Assignee: Bruno Faccini (Inactive)
• Reporter: Sebastien Buisson (Inactive)

Description

Hi,

CEA had 3 consecutive crashes of MDS server due to a corruption of kernel slab, and these crashes were concomitant to Robinhood startup.

In fact in the Lustre Changelogs we can see a line like:

4281746500 01CREAT 17:47:33.690285184 2014.03.25 0x0 t=[0x22cb19e89:0x1f9c9:0x0] p=[0x22cb19e89:0x1f9c8:0x0] GRANDEURS_CENTREES

And this is because Robinhood tried to process this Changelog entry that we crashed the MDS. Indeed, looking at the MDT with debugfs, we found out that this file was under the /OBJECTS directory (it used to be a regular file, that was moved here by Lustre for an unkown reason), and that its link EA was containing zero fid (link = "df f1 ea 11 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 " (24)).

This issue can be reproduced by doing the following on a Lustre filesystem originally formatted with Lustre 2.1, and upgraded to Lustre 2.4:

• on a Lustre client :

1. touch <lustre dir>/file
2. lfs path2fid <lustre dir>/file

• stop the file system and mount the MDT with ldiskfs
• move the file from <mdt ldiskfs>/ROOT/file to <mdt ldiskfs>/OBJECTS directory
• with setfattr change the link EA to remove all links :

1. setfattr -n trusted.link -v 0xdff1ea110000000018000000000000000000000000000000 <mdt ldiskfs>/OBJECTS/file

• umount ldiskfs MDT and restart the file system
• on a Lustre client :

1. lfs fid2path <lustre dir> <fid obtained at first step>

• the MDS server crashes

The crash can be avoided with the patch from LU-3474 at http://review.whamcloud.com/10464 .
But the scenario at CEA is worst that the error case found by Andreas (lfs fid2path on old IGIF FIDs) because here it crashes the MDS.

So at first we would need this patch to be landed to b2_4, or at least to know if this patch is suitable for use in production with Lustre 2.4.3.

Secondly, given that a file system at CEA has more than 5,000 files in the OBJECTS directory, we are wondering:
a) why some regular files are moved to OBJECTS directory? what is the Lustre mechanism leading to this?
b) why link EA contains zero fid when files are moved to OBJECTS directory?
c) why moving files to OBJECTS directory generates an entry in Lustre Changelogs?

TIA,
Sebastien.

Issue Links

• is related to: LU-3474 MDS LBUG on unlink?

Comments

[Andreas Dilger]

I verified that the 10464 patch is matching the fix that was landed for 2.5.0 (in 2.4.52, just after b2_4 was branched off master). I believe the patch should be safe for your production use in 2.4 (and we are planning to land it for the next 2.4.x release).

As for files in OBJECTS, that is confusing since this directory should only be used for nameless objects such as the quota admin files, and such. Regular files should not end up there. It appears almost as if the OBJECTS directory was being confused with the PENDING directory, for files that are open but unlinked. In that case, it would make sense that the "link" xattr has no links anymore, since there are no names for this file anymore. If possible, could you please check the FIDs on both the /OBJECTS and /PENDING to see if they conflict? You can do this while the MDT is mounted using:

debugfs -c -f /dev/stdin /dev/\{mdsdev\} <<-EOF
stat /OBJECTS
stat /PENDING
EOF

[Antoine Percher]

Hi Bruno
Agree with Sebastien the patch http://review.whamcloud.com/10464 could resolve the issue
But for me that's not enough and I attach my full crash analyze report with my proposal fix
to fix definitivly all corupt strcpy risk ...
I confirm also that the CREAT changelog entry is the entry when the file was created the 2014.03.25
And I don't know when the file was moved on the OBJECTS directory
Antoine

[Sebastien Buisson (Inactive)]

Here is the information from the crash dump, get by Antoine.

[Sebastien Buisson (Inactive)]

Hey Bruno!

a) lfsck was run on the file system, but many files under /OBJECTS directory have a creation date later that the time when lfsck was run. So lfsck is not responsible for this.
b) indeed, EA fid zeroing could have occurred before. But all files under /OBJECTS have a link EA containing zero fid, so both events must be related.
c) I will ask people on Site if the entry in the Changelogs corresponds to the initial regular file creation, or if it matches its move to /OBJECTS. But as Robinhood consumes Changelog entries as they appear, it would be surprising if the entry corresponds to its initial creation, as it could have occurred a long time before its move to /OBJECTS.

Concerning the ticket's priority, I would need to know if the patch at http://review.whamcloud.com/10464 can be used in production before lowering priority.

Sebastien.

[Bruno Faccini (Inactive)]

Sebastien, you speak about a corruption of Kernel slabs, can you better detail this ? Do you have at least a panic stack ?

Fan Yong, just in case, do you have any idea why/how files can be "moved" to OBJECTS directory ?

[Bruno Faccini (Inactive)]

Hello Sebastien,
Thanks for this report, but I have more comments/questions in mind :
a) I agree, we need to find this.
b) what let's you think that link EA fid/name zeroing occurs during the "move" to OBJECTS directory ?
c) similarly, why do you think this "move" is responsible of an entry in Lustre ChangeLogs ? Could it not be possible that the entry comes from the earlier file creation in the name-space and then it has been later used/referenced by RobinHood, finally causing the LBUG ?

Last, since you identified that patch from LU-3474 at http://review.whamcloud.com/10464, that unfortunately was missing to be merged in b2_4 until recently, can we decrease the priority of this ticket ?