[LU-7065] lod_add_device() may free an already added target description

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.8.0
• Affects Version/s: Lustre 2.8.0
• Labels: lod
• Severity: 3
• Assignee: Dmitry Eremin (Inactive)
• Reporter: John Hammond

Description

In the error path of lod_add_device() we may free tgt_desc after adding it to the ldt:

        LTD_TGT(ltd, index) = tgt_desc;
        cfs_bitmap_set(ltd->ltd_tgt_bitmap, index);
        ltd->ltd_tgtnr++;
        mutex_unlock(&ltd->ltd_mutex);
        lod_putref(lod, ltd);
        lock = false;
        if (lod->lod_recovery_completed)
                ldev->ld_ops->ldo_recovery_complete(env, ldev);

        if (!for_ost && lod->lod_initialized) {
                rc = lod_sub_init_llog(env, lod, tgt_desc->ltd_tgt);
                if (rc != 0) {
                        CERROR("%s: cannot start llog on %s:rc = %d\n",
                               lod2obd(lod)->obd_name, osp, rc);
                        GOTO(out_pool, rc);
                }
        }

        rc = lfsck_add_target(env, lod->lod_child, d, exp, index, for_ost);
        if (rc != 0) {
                CERROR("Fail to add LFSCK target: name = %s, type = %s, "
                       "index = %u, rc = %d\n", osp, type, index, rc);
                GOTO(out_fini_llog, rc);
        }
        RETURN(rc);
out_fini_llog:
        lod_sub_fini_llog(env, tgt_desc->ltd_tgt,
                          tgt_desc->ltd_recovery_thread);
out_pool:
        lod_ost_pool_remove(&lod->lod_pool_info, index);
out_mutex:
        if (lock) {
                mutex_unlock(&ltd->ltd_mutex);
                lod_putref(lod, ltd);
        }
out_desc:
        OBD_FREE_PTR(tgt_desc);