[LU-2845] NULL pointer deref in osp_precreate_thread()

Wed, 20 Mar 2013 21:35:46 +0000

After reproducing ~~LU-2843~~ to fill the changelog catalog, mounting the MDT results in a NULL pointer dereference. (This is a separate incident using a different MDT from ~~LU-2844~~).

Lustre: Lustre: Build Version: 2.3.58-g4f361a2-CHANGED-2.6.32-279.9.1.1chaos.ch5.1.x86_64
LNet: Added LNI 192.168.122.43@tcp [8/256/0/180]
LNet: Accept secure, port 988
LDISKFS-fs (sda): recovery complete
LDISKFS-fs (sda): mounted filesystem with ordered data mode. quota=on. Opts: 
Lustre: lustre-MDT0000: used disk, loading
Lustre: 4351:0:(mdt_lproc.c:380:lprocfs_wr_identity_upcall()) lustre-MDT0000: identity upcall set to /home/bass6/lustre-release/lustre/tests/../utils/l_getidentity
LustreError: 4351:0:(osd_io.c:1075:osd_ldiskfs_write_record()) sda: error reading offset 0 (block 0): rc = -28
LustreError: 4351:0:(llog_osd.c:157:llog_osd_write_blob()) lustre-MDT0000-osd: error writing log record: rc = -28
LustreError: 4351:0:(osd_io.c:1075:osd_ldiskfs_write_record()) sda: error reading offset 0 (block 0): rc = -28
LustreError: 4351:0:(llog_osd.c:157:llog_osd_write_blob()) lustre-MDT0000-osd: error writing log record: rc = -28
LustreError: 4351:0:(llog_cat.c:371:llog_cat_add_rec()) llog_write_rec -28: lh=ffff88007ce78900
LustreError: 4351:0:(osp_sync.c:1029:osp_sync_init()) lustre-OST0000-osc-MDT0000: can't initialize llog: rc = -28
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa1055b64>] osp_precreate_thread+0x1e4/0x1460 [osp]
PGD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/module/fid/initstate
CPU 2 
Modules linked in: osp(U) lod(U) mdt(U) mgs(U) mgc(U) fsfilt_ldiskfs(U) osd_ldiskfs(U) ldiskfs(U) lquota(U) mdd(U) lustre(U) lov(U) osc(U) mdc(U) fid(U) fld(U) ksocklnd(U) ptlrpc(U) obdclass(U) lnet(U) lvfs(U) sha512_generic sha256_generic libcfs(U) ebtable_nat ebtables fuse autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 zfs(P)(U) zcommon(P)(U) znvpair(P)(U) zavl(P)(U) zunicode(P)(U) spl(U) zlib_deflate vhost_net macvtap macvlan tun kvm virtio_balloon virtio_net sg snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc i2c_piix4 i2c_core ext4 mbcache jbd2 virtio_blk sd_mod crc_t10dif pata_acpi ata_generic ata_piix virtio_pci virtio_ring virtio dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid: 4358, comm: osp-pre-0 Tainted: P           ---------------    2.6.32-279.9.1.1chaos.ch5.1.x86_64 #1 Bochs Bochs
RIP: 0010:[<ffffffffa1055b64>]  [<ffffffffa1055b64>] osp_precreate_thread+0x1e4/0x1460 [osp]
RSP: 0018:ffff88005ac43df0  EFLAGS: 00010246
RAX: ffff88005d266238 RBX: ffff88005b3b3800 RCX: 0000000000000000
RDX: ffff88005b3b39c0 RSI: 0000000000000282 RDI: 0000000000000282
RBP: ffff88005ac43f40 R08: ffff88005ac43e88 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88005b3b3918
R13: ffff88005ac43eb0 R14: 0000000000000000 R15: 0000000000000001
FS:  00007f126b13a700(0000) GS:ffff880002300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000001a85000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process osp-pre-0 (pid: 4358, threadinfo ffff88005ac42000, task ffff88007ab3caa0)
Stack:
 000000000019f72b 0000001f0000000a 00000000000e525d 000000000019f738
<d> 0000001f0000000a ffff88005b3b3920 ffff88005b3b3918 ffff88005b3b3980
<d> ffff88007ab3caa0 ffff88007ab3caa0 ffff88007ab3caa0 ffff88007ab3caa0
Call Trace:
 [<ffffffff810602a0>] ? default_wake_function+0x0/0x20
 [<ffffffffa1055980>] ? osp_precreate_thread+0x0/0x1460 [osp]
 [<ffffffff8100c14a>] child_rip+0xa/0x20
 [<ffffffffa1055980>] ? osp_precreate_thread+0x0/0x1460 [osp]
 [<ffffffffa1055980>] ? osp_precreate_thread+0x0/0x1460 [osp]
 [<ffffffff8100c140>] ? child_rip+0x0/0x20
Code: 00 85 d2 0f 84 80 11 00 00 c7 83 00 01 00 00 00 00 00 00 c7 83 04 01 00 00 00 00 00 00 48 8b 83 a8 00 00 00 4c 8b b0 b8 0d 00 00 <49> 83 3e 00 0f 84 72 04 00 00 48 89 df 49 be 00 00 00 00 ff ff 
RIP  [<ffffffffa1055b64>] osp_precreate_thread+0x1e4/0x1460 [osp]
 RSP <ffff88005ac43df0>
CR2: 0000000000000000

crash> bt
PID: 4358   TASK: ffff88007ab3caa0  CPU: 2   COMMAND: "osp-pre-0"
 #0 [ffff88005ac439e0] machine_kexec at ffffffff8103283b
 #1 [ffff88005ac43a40] crash_kexec at ffffffff810ba492
 #2 [ffff88005ac43b10] oops_end at ffffffff81501e60
 #3 [ffff88005ac43b40] no_context at ffffffff81043bfb
 #4 [ffff88005ac43b90] __bad_area_nosemaphore at ffffffff81043e85
 #5 [ffff88005ac43be0] bad_area_nosemaphore at ffffffff81043f53
 #6 [ffff88005ac43bf0] __do_page_fault at ffffffff810446b1
 #7 [ffff88005ac43d10] do_page_fault at ffffffff81503e3e
 #8 [ffff88005ac43d40] page_fault at ffffffff815011f5
    [exception RIP: osp_precreate_thread+484]
    RIP: ffffffffa1055b64  RSP: ffff88005ac43df0  RFLAGS: 00010246
    RAX: ffff88005d266238  RBX: ffff88005b3b3800  RCX: 0000000000000000
    RDX: ffff88005b3b39c0  RSI: 0000000000000282  RDI: 0000000000000282
    RBP: ffff88005ac43f40   R8: ffff88005ac43e88   R9: 00000000ffffffff
    R10: 0000000000000000  R11: 0000000000000000  R12: ffff88005b3b3918
    R13: ffff88005ac43eb0  R14: 0000000000000000  R15: 0000000000000001
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #9 [ffff88005ac43f48] kernel_thread at ffffffff8100c14a
crash>

(gdb) l *(osp_precreate_thread+0x1e4)
0xeb84 is in osp_precreate_thread (/home/bass6/lustre-release/lustre/osp/osp_precreate.c:926).
921                             d->opd_new_connection = 0;
922                             d->opd_got_disconnected = 0;
923                             break;
924                     }
925
926                     if (d->opd_obd->u.cli.cl_seq->lcs_exp == NULL) {
927                             /* Get new sequence for client first */
928                             LASSERT(d->opd_exp != NULL);
929                             d->opd_obd->u.cli.cl_seq->lcs_exp =
930                             class_export_get(d->opd_exp);
(gdb)

Whamcloud Community JIRA

[LU-2845] NULL pointer deref in osp_precreate_thread()