[LU-13487] racer: cl_object_flush+0x48 general protection fault: 0000

Sun, 16 Jan 2022 08:45:35 +0000
Several racer runs crashed with that trace:
[45581.955610] general protection fault: 0000 [#1] SMP 
[45581.956639] Modules linked in: mgc(OE) lustre(OE) lmv(OE) mdc(OE) fid(OE) osc(OE) lov(OE) fld(OE) ksocklnd(OE) ptlrpc(OE) obdclass(OE) lnet(OE) libcfs(OE) rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache ib_isert iscsi_target_mod ib_srpt target_core_mod crc_t10dif crct10dif_generic ib_srp scsi_transport_srp scsi_tgt rpcrdma ib_umad rdma_ucm ib_ipoib ib_iser rdma_cm iw_cm libiscsi scsi_transport_iscsi ib_cm mlx4_ib ib_uverbs ib_core sunrpc ppdev parport_pc iosf_mbi crc32_pclmul ghash_clmulni_intel virtio_balloon aesni_intel i2c_piix4 lrw gf128mul glue_helper ablk_helper joydev pcspkr cryptd parport ip_tables ext4 mbcache jbd2 ata_generic pata_acpi mlx4_en ptp pps_core virtio_blk mlx4_core ata_piix libata 8139too crct10dif_pclmul crct10dif_common crc32c_intel 8139cp serio_raw
[45581.969957]  virtio_pci floppy devlink virtio_ring mii virtio [last unloaded: libcfs]
[45581.971218] CPU: 1 PID: 11037 Comm: ldlm_bl_04 Kdump: loaded Tainted: G           OE  ------------   3.10.0-1062.1.1.el7.x86_64 #1
[45581.973040] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[45581.973952] task: ffff884e5ddf8000 ti: ffff884e62f8c000 task.ti: ffff884e62f8c000
[45581.975121] RIP: 0010:[<ffffffffc0b852f8>]  [<ffffffffc0b852f8>] cl_object_flush+0x48/0x120 [obdclass]
[45581.976853] RSP: 0018:ffff884e62f8fb28  EFLAGS: 00010296
[45581.977701] RAX: 5a5a5a5a5a5a5a5a RBX: 5a5a5a5a5a5a5a42 RCX: 0000000000000000
[45581.978817] RDX: ffff884e46db59d8 RSI: 0000000000000292 RDI: 0000000000000292
[45581.979936] RBP: ffff884e62f8fb48 R08: 0000000000000000 R09: ffffffffbcada0b0
[45581.981050] R10: ffff884e7fd25350 R11: fffff5f0c13b3e80 R12: ffff884e4ecfa778
[45581.982161] R13: ffff884e4c921998 R14: ffff884e4ae7cfc0 R15: 0000000000000000
[45581.983275] FS:  0000000000000000(0000) GS:ffff884e7fd00000(0000) knlGS:0000000000000000
[45581.984537] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[45581.985440] CR2: 00007f1e7ef1b9e5 CR3: 0000000008810000 CR4: 00000000000606e0
[45581.986557] Call Trace:
[45581.987032]  [<ffffffffc0f2a55c>] lov_flush_composite+0x17c/0x1d0 [lov]
[45581.988087]  [<ffffffffc0f29352>] lov_object_flush+0x22/0x60 [lov]
[45581.989078]  [<ffffffffc0b85313>] cl_object_flush+0x63/0x120 [obdclass]
[45581.990243]  [<ffffffffc107c4ee>] ll_lock_cancel_bits+0x3ce/0x9f0 [lustre]
[45581.991339]  [<ffffffffc107d258>] ll_md_blocking_ast+0x248/0x2b0 [lustre]
[45581.992605]  [<ffffffffc0dcd54a>] ldlm_cancel_callback+0x8a/0x330 [ptlrpc]
[45581.993759]  [<ffffffffc0a1a423>] ? cfs_trace_unlock_tcd+0x33/0x90 [libcfs]
[45581.994889]  [<ffffffffc0dd8460>] ldlm_cli_cancel_local+0xa0/0x3f0 [ptlrpc]
[45581.996014]  [<ffffffffc0dde1c1>] ldlm_cli_cancel+0x161/0x650 [ptlrpc]
[45581.997045]  [<ffffffffc107d0fa>] ll_md_blocking_ast+0xea/0x2b0 [lustre]
[45581.998117]  [<ffffffffc0de29dd>] ldlm_handle_bl_callback+0xed/0x4e0 [ptlrpc]
[45581.999271]  [<ffffffffc0de35d0>] ldlm_bl_thread_main+0x800/0xa40 [ptlrpc]
[45582.000387]  [<ffffffffbcada0b0>] ? wake_up_state+0x20/0x20
[45582.001278]  [<ffffffffc0de2dd0>] ? ldlm_handle_bl_callback+0x4e0/0x4e0 [ptlrpc]
[45582.002449]  [<ffffffffbcac50d1>] kthread+0xd1/0xe0
[45582.003228]  [<ffffffffbcac5000>] ? insert_kthread_work+0x40/0x40
[45582.004211]  [<ffffffffbd18cd37>] ret_from_fork_nospec_begin+0x21/0x21
[45582.005247]  [<ffffffffbcac5000>] ? insert_kthread_work+0x40/0x40
[45582.006204] Code: 4c 8b 26 74 0d f6 05 03 ac eb ff 20 0f 85 91 00 00 00 49 8b 44 24 40 49 83 c4 40 49 39 c4 48 8d 58 e8 74 33 0f 1f 80 00 00 00 00 <48> 8b 43 28 48 8b 40 68 48 85 c0 74 12 4c 89 f2 48 89 de 4c 89 
[45582.011184] RIP  [<ffffffffc0b852f8>] cl_object_flush+0x48/0x120 [obdclass]
[45582.012327]  RSP <ffff884e62f8fb28>
That looks like access to freed layout from lov_flush_composite(), though it is not clear yet how that can happen and should be investigated.
Whamcloud Community JIRA

[LU-13487] racer: cl_object_flush+0x48 general protection fault: 0000
