This is indeed not related to quota (the crash is in the client code). I'm checking the lmv code in case i can put the finger on something, but i'm afraid that more information (a crash dump?) will be required ...
I have a crashdump for this.
Ah, i missed this. Could you please upload it to brent?
lu2175.tar.bz2 and vmlinux.bz2 in my home dir on brent
Trying to map the address, i get:
(gdb) list *(ptlrpc_set_wait+1541)
0x41945 is in ptlrpc_set_wait (/home/green/git/lustre-release/lustre/ptlrpc/client.c:2121).
2116 /home/green/git/lustre-release/lustre/ptlrpc/client.c: No such file or directory.
2107 int ptlrpc_set_wait(struct ptlrpc_request_set *set)
2108 {
2109 cfs_list_t *tmp;
2110 struct ptlrpc_request *req;
2111 struct l_wait_info lwi;
2112 int rc, timeout;
2113 ENTRY;
2114
2115 if (set->set_producer)
2116 (void)ptlrpc_set_producer(set);
2117 else
2118 cfs_list_for_each(tmp, &set->set_requests) {
2119 req = cfs_list_entry(tmp, struct ptlrpc_request,
2120 rq_set_chain);
2121 if (req->rq_phase == RQ_PHASE_NEW)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2122 (void)ptlrpc_send_new_req(req);
2123 }
So it seems that we crashed while trying to access a request from set_requests.
Dumping the set, i get:
crash> px *((struct ptlrpc_request_set *)0xffff88001f9ddf30)
$9 = {
set_refcount = {
counter = 0x1
},
set_new_count = {
counter = 0x0
},
set_remaining = {
counter = 0x1
},
set_waitq = {
lock = {
raw_lock = {
slock = 0x0
},
magic = 0xdead4ead,
owner_cpu = 0xffffffff,
owner = 0xffffffffffffffff
},
task_list = {
next = 0xffff88001f9ddf58,
prev = 0xffff88001f9ddf58
}
},
set_wakeup_ptr = 0x0,
set_requests = {
next = 0xffff8800ae00de88,
prev = 0xffff8800ae00de88
^^^^^^^^^^^^^^^^^^^
},
set_cblist = {
next = 0xffff88001f9ddf80,
prev = 0xffff88001f9ddf80
},
set_interpret = 0,
set_arg = 0x0,
set_new_req_lock = {
raw_lock = {
slock = 0x0
},
magic = 0xdead4ead,
owner_cpu = 0xffffffff,
owner = 0xffffffffffffffff
},
set_new_requests = {
next = 0xffff88001f9ddfb8,
prev = 0xffff88001f9ddfb8
},
set_rc = 0x0,
set_max_inflight = 0xffffffff,
set_producer = 0,
set_producer_arg = 0x0
}
So there is indeed a request in set_requests, which is:
(gdb) p &(((struct ptlrpc_request *)0)->rq_set_chain)
$4 = (cfs_list_t *) 0x298
(gdb) p/x (0xffff8800ae00de88 - 0x298)
$5 = 0xffff8800ae00dbf0
crash> px *((struct ptlrpc_request *)(0xffff8800ae00dbf0))
$18 = {
rq_type = 0x1267,
rq_status = 0x0,
rq_list = {
next = 0xffff88008ad47890,
prev = 0xffff88008ad47890
},
rq_timed_list = {
next = 0xffff8900ae00dc08,
prev = 0xffff8800ae00dc08
},
rq_history_list = {
next = 0xffff8900ae00dc18,
prev = 0xffff8900ae00dc18
},
rq_exp_list = {
next = 0xffff8900ae00dc28,
prev = 0xffff8800ae00dc28
},
rq_ops = 0x10000000000,
rq_svc_thread = 0x0,
rq_history_seq = 0x0,
rq_at_index = 0x0,
rq_lock = {
raw_lock = {
slock = 0x0
},
magic = 0xdead4ead,
owner_cpu = 0xffffffff,
owner = 0xffffffffffffffff
},
rq_intr = 0x0,
rq_replied = 0x1,
rq_err = 0x0,
rq_timedout = 0x0,
rq_resend = 0x0,
rq_restart = 0x0,
rq_replay = 0x1,
rq_no_resend = 0x0,
rq_waiting = 0x0,
rq_receiving_reply = 0x0,
rq_no_delay = 0x0,
rq_net_err = 0x0,
rq_wait_ctx = 0x0,
rq_early = 0x0,
rq_must_unlink = 0x1,
rq_fake = 0x0,
rq_memalloc = 0x0,
rq_packed_final = 0x0,
rq_hp = 0x0,
rq_at_linked = 0x0,
rq_reply_truncate = 0x0,
rq_committed = 0x0,
rq_invalid_rqset = 0x0,
rq_generation_set = 0x0,
rq_no_retry_einprogress = 0x1,
rq_nr_resend = 0x0,
rq_phase = 3955285505,
rq_next_phase = 3955285510,
rq_refcount = {
counter = 0x2
},
rq_request_portal = 0x10c,
rq_reply_portal = 0xa,
rq_nob_received = 0x258,
rq_reqlen = 0x348,
rq_replen = 0x470,
rq_reqmsg = 0xffff8900ae00cbf0,
rq_repmsg = 0x0,
rq_transno = 0x10000000000,
rq_xid = 0x507a5fe4aac3c,
rq_replay_list = {
next = 0xffff8800ae00dcb8,
prev = 0xffff8800ae00dcb8
},
rq_cli_ctx = 0xffffffffa0677380,
rq_svc_ctx = 0x0,
rq_ctx_chain = {
next = 0xffff8800ae00dcd8,
prev = 0xffff8800ae00dcd8
},
rq_flvr = {
sf_rpc = 0x0,
sf_flags = 0x0,
u_rpc = {<No data fields>},
u_bulk = {
hash = {
hash_alg = 0x0
}
}
},
rq_sp_from = LUSTRE_SP_CLI,
rq_ctx_init = 0x0,
rq_ctx_fini = 0x0,
rq_bulk_read = 0x0,
rq_bulk_write = 0x0,
rq_auth_gss = 0x0,
rq_auth_remote = 0x0,
rq_auth_usr_root = 0x0,
rq_auth_usr_mdt = 0x0,
rq_auth_usr_ost = 0x0,
rq_pack_udesc = 0x0,
rq_pack_bulk = 0x0,
rq_no_reply = 0x0,
rq_pill_init = 0x1,
rq_auth_uid = 0x0,
rq_auth_mapped_uid = 0x0,
rq_user_desc = 0x10000000000,
rq_reqbuf = 0xffff8800ae00cbf0,
rq_repbuf = 0xffff8800ae00e7f0 "",
rq_repdata = 0x0,
rq_clrbuf = 0x0,
rq_reqbuf_len = 0x400,
rq_reqdata_len = 0x248,
rq_repbuf_len = 0x800,
rq_repdata_len = 0x0,
rq_clrbuf_len = 0x0,
rq_clrdata_len = 0x0,
rq_reply_off = 0xc0,
rq_req_swab_mask = 0x0,
rq_rep_swab_mask = 0x0,
rq_import_generation = 0x1,
rq_send_state = LUSTRE_IMP_FULL,
rq_early_count = 0x0,
rq_req_md_h = {
cookie = 0x2266a11
},
rq_req_cbid = {
cbid_fn = 0xffffffffa05b1720,
cbid_arg = 0xffff8800ae00dbf0
},
rq_delay_limit = 0x0,
rq_queued_time = 0x10006c6be,
rq_arrival_time = {
tv_sec = 0x507a6575,
tv_usec = 0xe6e6b
},
rq_reply_state = 0x10000000000,
rq_rqbd = 0x0,
rq_reply_md_h = {
cookie = 0x2266a09
},
rq_reply_waitq = {
lock = {
raw_lock = {
slock = 0x0
},
magic = 0xdead4ead,
owner_cpu = 0xffffffff,
owner = 0xffffffffffffffff
},
task_list = {
next = 0xffff8800ae00ddc8,
prev = 0xffff8800ae00ddc8
}
},
rq_reply_cbid = {
cbid_fn = 0xffffffffa05b22c0,
cbid_arg = 0xffff8800ae00dbf0
},
rq_self = 0x0,
rq_peer = {
nid = 0x0,
pid = 0x0
},
rq_export = 0x10000000000,
rq_import = 0xffff89008ad477f0,
rq_replay_cb = 0,
rq_commit_cb = 0x10000000000,
rq_cb_data = 0x10000000000,
rq_bulk = 0x0,
rq_sent = 0x507a6575,
rq_real_sent = 0x507a6575,
rq_deadline = 0x507a65a1,
rq_reply_deadline = 0x0,
rq_bulk_deadline = 0x0,
rq_timeout = 0x2b,
rq_set_waitq = {
lock = {
raw_lock = {
slock = 0x0
},
magic = 0xdead4ead,
owner_cpu = 0xffffffff,
owner = 0xffffffffffffffff
},
task_list = {
next = 0xffff8800ae00de78,
prev = 0xffff8800ae00de78
}
},
rq_set_chain = {
next = 0xffff89001f9ddf70,
prev = 0xffff89001f9ddf70
},
rq_set = 0xffff88001f9ddf30,
rq_interpret_reply = 0,
rq_async_args = {
pointer_arg = {0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
space = {0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x0}
},
rq_pool = 0x0,
rq_session = {
lc_tags = 0x0,
lc_state = 0,
lc_thread = 0x10000000000,
lc_value = 0x10000000000,
lc_remember = {
next = 0x0,
prev = 0x0
},
lc_version = 0x0,
lc_cookie = 0x0
},
rq_recov_session = {
lc_tags = 0x0,
lc_state = 0,
lc_thread = 0x0,
lc_value = 0x0,
lc_remember = {
next = 0x0,
prev = 0x0
},
lc_version = 0x0,
lc_cookie = 0x0
},
rq_pill = {
rc_req = 0xffff8800ae00dbf0,
rc_fmt = 0xffffffffa064f8a0,
rc_loc = RCL_CLIENT,
rc_area = {{0xb8, 0x68, 0x8, 0x88, 0x100, 0x0, 0x10b, 0x48, 0xfffffeff}, {0xb8, 0x70, 0xd8, 0x38, 0x104, 0x178, 0x78, 0xfffffeff, 0xffffffff}}
}
rq_set_chain = {
next = 0xffff89001f9ddf70,
prev = 0xffff89001f9ddf70
},
So the request almost points back to the set 0xffff89001f9ddf70 = 0xffff88001f9ddf30(set address) + 0x40(set_requests offset) + .... 0x10000000000. It seems that there was a bit swap 
I talked to Oleg and he indeed experienced some memory issues which are likely the root cause of this crash.