|
This bug is introduced in by commit 07b8db220e48782369f48d86213c5d404a628ded , which make ptlrpc_server_drop_request() not to hold at_lock for checking req::rq_at_linked. This change might race with ptlrpc_at_check_timed() if:
- thread-1: call ptlrpc_at_check_timed() and remove the request from paa_reqs_array, before it set req::rq_at_linked to zero...
- thread-2: call ptlrpc_server_drop_request() to release the last refcount, and it found req::rq_at_linked is non-zero, so it entered the condition "if (req->rq_at_linked)
{...}
"
- thread-1: set req::rq_at_linked to zero
- thread-2: take at_lock, and hit LASSERT(!cfs_list_empty(&req->rq_timed_list)) because thread-1 has already removed req::rq_at_linked from paa_reqs_array in step-1
|