A customer using 2.7.6 reported a crash in mdcache_lru_clean(..) when "entry->sub_handle" had an unexpected address.

 

It is happening when lru_reap_chunk_impl(..) calls mdcache_put(..) in the following code:

 815                 if (entry == parent ||
 816                     pthread_rwlock_trywrlock(&entry->content_lock) == 0) {
 ...
 819                         if (entry != parent) {
 ...
 823                                 (void) atomic_inc_int32_t(&entry->lru.refcnt);
 824                         }
 825
 826                         /* Dequeue the chunk so it won't show up anymore */
 827                         CHUNK_LRU_DQ_SAFE(lru, lq);
 828                         chunk->chunk_lru.qid = LRU_ENTRY_NONE;
 ...
 839                         mdcache_clean_dirent_chunk(chunk);
 840                         atomic_clear_uint32_t_bits(&entry->mde_flags,
 841                                                    MDCACHE_DIR_POPULATED);
 842
 843                         if (entry != parent) {
 ...
 848                                 PTHREAD_RWLOCK_unlock(&entry->content_lock);
 849                                 mdcache_put(entry);
 850                         }
 

At the time of crash:

 

Has anybody seen this kind of crash ? Any patches that may help to fix the crash ?  We have the customer coredump, so can provide more information using it.

 

Backtrace for reference: