[LU-5858] lu_object_find_slice() returns NULL and ERR_PTRs

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.7.0
• Affects Version/s: Lustre 2.7.0
• Labels: ERR_PTR obdclass
• Severity: 3
• Assignee: Bob Glossman (Inactive)
• Reporter: John Hammond

Description

lu_object_find_slice() may return NULL or an ERR_PTR. Not all callers of cl_object_find() and mdd_object_find() will handle a NULL return properly. Here is an example (found via RPC fault injection) where cl_object_find() has returned NULL, this was not detected to be an error, and NULL was assigned to lli_clob.

[70908.947212] LustreError: 10435:0:(lcommon_cl.c:1162:cl_file_inode_init()) Failure to initialize cl object [0x2c0000400:0x172:0x0]: -5
[70908.949691] LustreError: 10435:0:(llite_lib.c:2416:ll_prep_inode()) new_inode -fatal: rc -5
[70908.949859] BUG: unable to handle kernel NULL pointer dereference at (null)
[70908.949861] IP: [<ffffffffa06be04e>] cl_object_top+0xe/0x150 [obdclass]
[70908.949906] PGD 0 
[70908.949908] Oops: 0000 [#1] SMP 
[70908.949910] last sysfs file: /sys/devices/system/cpu/possible
[70908.949915] CPU 1 
[70908.949916] Modules linked in: lustre(U) ofd(U) osp(U) lod(U) ost(U) mdt(U) mdd(U) mgs(U) osd_ldiskfs(U) ldiskfs(U) exportfs lquota(U) lfsck(U) jbd obdecho(U) mgc(U) lov(U) osc(U) mdc(U) lmv(U) fid(U) fld(U) ptlrpc(U) obdclass(U) ksocklnd(U) lnet(U) sha512_generic sha256_generic libcfs(U) autofs4 nfs lockd fscache auth_rpcgss nfs_acl sunrpc ipv6 zfs(U) zcommon(U) znvpair(U) zavl(U) zunicode(U) spl(U) zlib_deflate microcode virtio_net i2c_piix4 i2c_core virtio_balloon ext4 jbd2 mbcache virtio_blk virtio_pci virtio_ring virtio pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]
[70908.949964] 
[70908.949966] Pid: 10698, comm: ll_sa_10435 Not tainted 2.6.32-431.29.2.el6.lustre.x86_64 #1 Bochs Bochs
[70908.949969] RIP: 0010:[<ffffffffa06be04e>]  [<ffffffffa06be04e>] cl_object_top+0xe/0x150 [obdclass]
[70908.950001] RSP: 0018:ffff88004ef77ba0  EFLAGS: 00010286
[70908.950003] RAX: ffff88004c7bd710 RBX: ffff880054551e50 RCX: 0000000000000000
[70908.950006] RDX: ffff88004f541978 RSI: ffffffffa06fffe0 RDI: 0000000000000000
[70908.950008] RBP: ffff88004ef77bb0 R08: 0000000000000001 R09: 0000000000000001
[70908.950010] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880049d04b48
[70908.950013] R13: 0000000000000005 R14: 0000000000000000 R15: ffff88004c7bd710
[70908.950015] FS:  0000000000000000(0000) GS:ffff88002c200000(0000) knlGS:0000000000000000
[70908.950018] CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
[70908.950020] CR2: 0000000000000000 CR3: 0000000117fd0000 CR4: 00000000000006e0
[70908.950030] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[70908.950034] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[70908.950036] Process ll_sa_10435 (pid: 10698, threadinfo ffff88004ef76000, task ffff88004d508200)
[70908.950037] Stack:
[70908.950038]  ffff88004ef77bb0 ffff880054551e50 ffff88004ef77bf0 ffffffffa06c7a6d
[70908.950041] <d> ffff88004ef77bf0 ffff88004ef77c1c ffff8800517b12b8 0000000000000001
[70908.950043] <d> 0000000000000001 0000000000000001 ffff88004ef77c40 ffffffffa0e0ff58
[70908.950046] Call Trace:
[70908.950074]  [<ffffffffa06c7a6d>] cl_io_init+0x3d/0xe0 [obdclass]
[70908.950097]  [<ffffffffa0e0ff58>] cl_glimpse_size0+0x78/0x120 [lustre]
[70908.950110]  [<ffffffffa0e0a5cb>] ll_agl_trigger+0xbb/0x270 [lustre]
[70908.950124]  [<ffffffffa0e0c389>] sa_handle_callback+0x4a9/0x820 [lustre]
[70908.950129]  [<ffffffff8109efc4>] ? remove_wait_queue+0x24/0x50
[70908.950143]  [<ffffffffa0e0e7bf>] ll_statahead_thread+0x3ef/0x14b0 [lustre]
[70908.950146]  [<ffffffff810b74bd>] ? trace_hardirqs_on+0xd/0x10
[70908.950150]  [<ffffffff81061d90>] ? default_wake_function+0x0/0x20
[70908.950163]  [<ffffffffa0e0e3d0>] ? ll_statahead_thread+0x0/0x14b0 [lustre]
[70908.950166]  [<ffffffff8109e856>] kthread+0x96/0xa0
[70908.950169]  [<ffffffff8100c30a>] child_rip+0xa/0x20
[70908.950173]  [<ffffffff815562e0>] ? _spin_unlock_irq+0x30/0x40
[70908.950175]  [<ffffffff8100bb10>] ? restore_args+0x0/0x30
[70908.950177]  [<ffffffff8109e7c0>] ? kthread+0x0/0xa0
[70908.950179]  [<ffffffff8100c300>] ? child_rip+0x0/0x20
[70908.950180] Code: 84 b8 fe ff ff 48 89 df e8 90 9c ac e0 48 c7 c3 f4 ff ff ff e9 25 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 0f 1f 44 00 00 <48> 8b 07 0f 1f 80 00 00 00 00 48 89 c2 48 8b 80 a0 00 00 00 48 
[70908.950198] RIP  [<ffffffffa06be04e>] cl_object_top+0xe/0x150 [obdclass]
[70908.950220]  RSP <ffff88004ef77ba0>
[70908.950221] CR2: 0000000000000000