b=14238, i=liangzhen, i=maxim:

-   NULL md_me in lnet_md_unlink().
-   iterate ptl_ml safely since 'me' can be removed within the loop.

lnet/ChangeLog

@@ -28,6 +28,10 @@ tbd         Cluster File Systems, Inc. <info@clusterfs.com>
 	mxlnd     - MX 1.2.1 or later,
 	ptllnd    - Portals 3.3 / UNICOS/lc 1.5.x, 2.0.x
 
+Severity   : normal
+Bugzilla   : 14238
+Description: ASSERTION(me == md->md_me) failed in lnet_match_md()
+
 Severity   : normal
 Bugzilla   : 12494
 Description: increase send queue size for ciblnd/openiblnd

lnet/lnet/lib-md.c

@@ -39,6 +39,7 @@ lnet_md_unlink(lnet_libmd_t *md)
                 /* Disassociate from ME (if any), and unlink it if it was created
                  * with LNET_UNLINK */
                 if (me != NULL) {
+                        md->md_me = NULL;
                         me->me_md = NULL;
                         if (me->me_unlink == LNET_UNLINK)
                                 lnet_me_unlink(me);

lnet/lnet/lib-me.c

@@ -145,7 +145,7 @@ lnet_me_unlink(lnet_me_t *me)
 {
         list_del (&me->me_list);
 
-        if (me->me_md) {
+        if (me->me_md != NULL) {
                 me->me_md->md_me = NULL;
                 lnet_md_unlink(me->me_md);
         }

lnet/lnet/lib-move.c

@@ -140,8 +140,8 @@ lnet_match_md(int index, int op_mask, lnet_process_id_t src,
               lnet_libmd_t **md_out)
 {
         lnet_portal_t    *ptl = &the_lnet.ln_portals[index];
-        struct list_head *tmp;
         lnet_me_t        *me;
+        lnet_me_t        *tmp;
         lnet_libmd_t     *md;
         int               rc;
 
@@ -154,11 +154,10 @@ lnet_match_md(int index, int op_mask, lnet_process_id_t src,
                 return LNET_MATCHMD_DROP;
         }
 
-        list_for_each (tmp, &ptl->ptl_ml) {
-                me = list_entry(tmp, lnet_me_t, me_list);
+        list_for_each_entry_safe (me, tmp, &ptl->ptl_ml, me_list) {
                 md = me->me_md;
 
-                 /* ME attached but MD not attached yet */
+                /* ME attached but MD not attached yet */
                 if (md == NULL)
                         continue;