[LU-5422] Null pointer dereferences in lu_cache_shrink()

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.7.0
• Affects Version/s: Lustre 2.7.0
• Severity: 3
• Assignee: Li Wei (Inactive)
• Reporter: Li Wei (Inactive)

Description

With obdclass loaded but not any targets mounted:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa0aed076>] lu_cache_shrink+0x156/0x310 [obdclass]
PGD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/online
CPU 0 
Modules linked in: lustre obdecho mgc lov osc mdc lmv fid fld ptlrpc obdclass ksocklnd lnet libcfs sha512_generic sha256
_generic ipv6 ppdev parport_pc parport e1000 i2c_piix4 i2c_core snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_dev
ice snd_pcm snd_timer snd soundcore snd_page_alloc sg ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom ahci pata_acpi at
a_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: libcfs]

Pid: 29, comm: kswapd0 Not tainted 2.6.32 #2 innotek GmbH VirtualBox/VirtualBox
RIP: 0010:[<ffffffffa0aed076>]  [<ffffffffa0aed076>] lu_cache_shrink+0x156/0x310 [obdclass]
RSP: 0018:ffff88007cc95c50  EFLAGS: 00010207
RAX: ffff88007cc94000 RBX: ffff88007cc95c60 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa0b3a000
RBP: ffff88007cc95ca0 R08: 00000000fffffffb R09: 00000000fffffffe
R10: 0000000000000000 R11: 0000000000000007 R12: ffffffffffffffe0
R13: 00000000000000d0 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000001a85000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process kswapd0 (pid: 29, threadinfo ffff88007cc94000, task ffff88007cc90ae0)
Stack:
 ffff88007cc95ca0 ffffffffa0089287 ffff88007cc95c60 ffff88007cc95c60
<d> ffff88007cc95cc0 ffff880051ffc880 0000000000000000 0000000000000000
<d> 00000000000000d0 0000000000013240 ffff88007cc95d00 ffffffff8113831a
Call Trace:
 [<ffffffffa0089287>] ? mb_cache_shrink_fn+0x37/0x140 [mbcache]
 [<ffffffff8113831a>] shrink_slab+0x8a/0x1a0
 [<ffffffff8113b6da>] balance_pgdat+0x59a/0x820
 [<ffffffff8112baed>] ? zone_watermark_ok_safe+0xad/0xc0
 [<ffffffff8113ba94>] kswapd+0x134/0x3b0
 [<ffffffff8109afa0>] ? autoremove_wake_function+0x0/0x40
 [<ffffffff8113b960>] ? kswapd+0x0/0x3b0
 [<ffffffff8109abf6>] kthread+0x96/0xa0
 [<ffffffff8100c20a>] child_rip+0xa/0x20
 [<ffffffff8109ab60>] ? kthread+0x0/0xa0
 [<ffffffff8100c200>] ? child_rip+0x0/0x20
Code: d1 7e f1 ff e9 fe fe ff ff 0f 1f 40 00 48 c7 c7 00 a0 b3 a0 e8 2c a1 a3 e0 4c 8b 35 05 21 07 00 4d 8d 66 e0 49 81 fe 70 f1 b5 a0 <4d> 8b 6c 24 20 74 66 49 83 ed 20 4c 89 7d b8 eb 0f 66 0f 1f 84 
RIP  [<ffffffffa0aed076>] lu_cache_shrink+0x156/0x310 [obdclass]
 RSP <ffff88007cc95c50>
CR2: 0000000000000000
---[ end trace 826a07528ae8ea58 ]---
Kernel panic - not syncing: Fatal exception
Pid: 29, comm: kswapd0 Tainted: G      D    ---------------    2.6.32 #2
Call Trace:
 [<ffffffff815254ac>] ? panic+0xa7/0x16f
 [<ffffffff815297d4>] ? oops_end+0xe4/0x100
 [<ffffffff8104a00b>] ? no_context+0xfb/0x260
 [<ffffffff8104a295>] ? __bad_area_nosemaphore+0x125/0x1e0
 [<ffffffff8104a363>] ? bad_area_nosemaphore+0x13/0x20
 [<ffffffff8104aabf>] ? __do_page_fault+0x31f/0x480
 [<ffffffff8152b6fe>] ? do_page_fault+0x3e/0xa0
 [<ffffffff81528ab5>] ? page_fault+0x25/0x30
 [<ffffffffa0aed076>] ? lu_cache_shrink+0x156/0x310 [obdclass]
 [<ffffffffa0089287>] ? mb_cache_shrink_fn+0x37/0x140 [mbcache]
 [<ffffffff8113831a>] ? shrink_slab+0x8a/0x1a0
 [<ffffffff8113b6da>] ? balance_pgdat+0x59a/0x820
 [<ffffffff8112baed>] ? zone_watermark_ok_safe+0xad/0xc0
 [<ffffffff8113ba94>] ? kswapd+0x134/0x3b0
 [<ffffffff8109afa0>] ? autoremove_wake_function+0x0/0x40
 [<ffffffff8113b960>] ? kswapd+0x0/0x3b0
 [<ffffffff8109abf6>] ? kthread+0x96/0xa0
 [<ffffffff8100c20a>] ? child_rip+0xa/0x20
 [<ffffffff8109ab60>] ? kthread+0x0/0xa0
 [<ffffffff8100c200>] ? child_rip+0x0/0x20

A fix is on its way...

Comments

[Li Wei (Inactive)]

The patch has landed to master. Resolved.

[Li Wei (Inactive)]

http://review.whamcloud.com/11244

[Li Wei (Inactive)]

Fixed "affected versions": the regression is not affecting b2_6, but only master.