b=7023

 - export can be failed asynchronously with regard to processing request.
   this case cause open rpc to be replied to zero transno. zero transno
   means no reference for request and open request gets freed after
   ll_file_open() though mdc_open_data still has a reference on the
   request. and this causes oops when mdc_close() tries to access the
   request. the workaround is to take additional reference on the request
   for mdc_open_data

diff --git a/lustre/mdc/mdc_request.c b/lustre/mdc/mdc_request.c
index bda8476..c526d75 100644 (file)
--- a/lustre/mdc/mdc_request.c
+++ b/lustre/mdc/mdc_request.c
@@ -471,7 +471,7 @@ int mdc_set_open_replay_data(struct obd_export *exp,
 
         och->och_mod = mod;
         mod->mod_och = och;
-        mod->mod_open_req = open_req;
+        mod->mod_open_req = ptlrpc_request_addref(open_req);
 
         memcpy(&rec->cr_replayid, &body->id1, sizeof rec->cr_replayid);
         open_req->rq_replay_cb = mdc_replay_open;
@@ -529,6 +529,7 @@ static void mdc_commit_close(struct ptlrpc_request *req)
         spin_lock(&open_req->rq_lock);
         open_req->rq_replay = 0;
         spin_unlock(&open_req->rq_lock);
+        ptlrpc_req_finished(open_req);
 }
 
 int mdc_close(struct obd_export *exp, struct obdo *oa,