[Bug 2157583] [NEW] NFS-Ganesha FSAL_CEPH AddExport segfaults in libcephfs

[Peter Sabaini]

Public bug reported:

On Ubuntu 26.04 / Resolute with Ceph Tentacle packages, `ganesha.nfsd`
segfaults when dynamically adding a CephFS export through DBus
`ExportMgr.AddExport`.

The crash occurs after FSAL_CEPH starts creating a CephFS mount and
immediately after the FSAL_CEPH reclaim-reset path logs:

```text
reclaim_reset :FSAL :DEBUG :Issuing reclaim reset for ganesha-...
```

GDB shows the faulting thread is a Ceph messenger dispatch thread inside
`MDSMap::decode()` from `libceph-common.so.2`, reached via
`libcephfs.so.2`.

This blocks the `ceph-nfs` charm on Resolute/Tentacle because the
`create-share` action writes an export object, calls
`ExportMgr.AddExport`, and then fails when Ganesha crashes before
replying.

```

## Affected versions

Observed on the reproducing unit:

```text
ceph-common              20.2.0-0ubuntu2
libcephfs2               20.2.0-0ubuntu2
nfs-ganesha              6.5-8
```

Environment:

```text
Ubuntu base: ubuntu at 26.04 amd64
Ceph release: Tentacle / 20.2.0
```


GDB backtrace excerpt

```text
Thread 64 "ms_dispatch" received signal SIGSEGV, Segmentation fault.
0x00007ffff719bff6 in MDSMap::decode(ceph::buffer::v15_2_0::list::iterator_impl<true>&) ()
   from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2

#0  0x00007ffff719bff6 in MDSMap::decode(ceph::buffer::v15_2_0::list::iterator_impl<true>&) ()
    from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
#1  0x00007ffff51e0c0f in ?? () from /usr/lib/x86_64-linux-gnu/libcephfs.so.2
#2  0x00007ffff51e1849 in ?? () from /usr/lib/x86_64-linux-gnu/libcephfs.so.2
#3  0x00007ffff6ded2c9 in Messenger::ms_deliver_dispatch(boost::intrusive_ptr<Message> const&) ()
    from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
#4  0x00007ffff6deb2a2 in DispatchQueue::entry() ()
    from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
#5  0x00007ffff6ec69a1 in DispatchQueue::DispatchThread::entry() ()
    from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
#6  0x00007ffff7aa40da in start_thread (arg=<optimized out>)
#7  0x00007ffff7b377ac in __GI___clone3 ()
```

** Affects: ceph (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to ceph in Ubuntu.
https://bugs.launchpad.net/bugs/2157583

Title:
  NFS-Ganesha FSAL_CEPH AddExport segfaults in libcephfs

Status in ceph package in Ubuntu:
  New

Bug description:
  On Ubuntu 26.04 / Resolute with Ceph Tentacle packages, `ganesha.nfsd`
  segfaults when dynamically adding a CephFS export through DBus
  `ExportMgr.AddExport`.

  The crash occurs after FSAL_CEPH starts creating a CephFS mount and
  immediately after the FSAL_CEPH reclaim-reset path logs:

  ```text
  reclaim_reset :FSAL :DEBUG :Issuing reclaim reset for ganesha-...
  ```

  GDB shows the faulting thread is a Ceph messenger dispatch thread
  inside `MDSMap::decode()` from `libceph-common.so.2`, reached via
  `libcephfs.so.2`.

  This blocks the `ceph-nfs` charm on Resolute/Tentacle because the
  `create-share` action writes an export object, calls
  `ExportMgr.AddExport`, and then fails when Ganesha crashes before
  replying.

  ```

  ## Affected versions

  Observed on the reproducing unit:

  ```text
  ceph-common              20.2.0-0ubuntu2
  libcephfs2               20.2.0-0ubuntu2
  nfs-ganesha              6.5-8
  ```

  Environment:

  ```text
  Ubuntu base: ubuntu at 26.04 amd64
  Ceph release: Tentacle / 20.2.0
  ```

  
  GDB backtrace excerpt

  ```text
  Thread 64 "ms_dispatch" received signal SIGSEGV, Segmentation fault.
  0x00007ffff719bff6 in MDSMap::decode(ceph::buffer::v15_2_0::list::iterator_impl<true>&) ()
     from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2

  #0  0x00007ffff719bff6 in MDSMap::decode(ceph::buffer::v15_2_0::list::iterator_impl<true>&) ()
      from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
  #1  0x00007ffff51e0c0f in ?? () from /usr/lib/x86_64-linux-gnu/libcephfs.so.2
  #2  0x00007ffff51e1849 in ?? () from /usr/lib/x86_64-linux-gnu/libcephfs.so.2
  #3  0x00007ffff6ded2c9 in Messenger::ms_deliver_dispatch(boost::intrusive_ptr<Message> const&) ()
      from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
  #4  0x00007ffff6deb2a2 in DispatchQueue::entry() ()
      from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
  #5  0x00007ffff6ec69a1 in DispatchQueue::DispatchThread::entry() ()
      from /usr/lib/x86_64-linux-gnu/ceph/libceph-common.so.2
  #6  0x00007ffff7aa40da in start_thread (arg=<optimized out>)
  #7  0x00007ffff7b377ac in __GI___clone3 ()
  ```

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/2157583/+subscriptions