Bug 788626

Summary: kernel BUG: unable to handle kernel NULL pointer dereference at (null) nfs4 code
Product: [Fedora] Fedora Reporter: Orion Poplawski <orion>
Component: kernelAssignee: nfs-maint
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 16CC: gansalmon, itamar, jlayton, jonathan, kernel-maint, madhu.chinakonda
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: 3.2.7-1.fc16 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-22 19:15:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Orion Poplawski 2012-02-08 16:23:17 UTC 
Description of problem:

42581.168133] BUG: unable to handle kernel NULL pointer dereference at   (null)
[42581.168201] IP: [<c0510330>] page_address+0x10/0xe0
[42581.168246] *pdpt = 0000000030ec6001 *pde = 0000000000000000 
[42581.168292] Oops: 0000 [#1] SMP 
[42581.168323] Modules linked in: des_generic rpcsec_gss_krb5 nfs fscache auth_rpcgss nfs_acl lockd snd_intel8x0 snd_ac97_codec ac97_bus ppdev snd_seq snd_seq_device snd_pcm parport_pc r8169 parport e100 mii i2c_i801 snd_timer snd soundcore snd_page_alloc iTCO_wdt iTCO_vendor_support microcode dcdbas uinput sunrpc usb_storage radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core [last unloaded: scsi_wait_scan]
[42581.168672] 
[42581.168686] Pid: 13478, comm: mv Not tainted 3.2.3-2.fc16.i686.PAE #1 Dell Inc.                 Dimension 4700               /0M3918
[42581.168774] EIP: 0060:[<c0510330>] EFLAGS: 00010286 CPU: 0
[42581.168817] EIP is at page_address+0x10/0xe0
[42581.168847] EAX: 00000000 EBX: ea111de0 ECX: e9a6b788 EDX: 00000060
[42581.168890] ESI: ea111b9c EDI: 00000000 EBP: ea111b84 ESP: ea111b74
[42581.168933]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[42581.168973] Process mv (pid: 13478, ti=ea110000 task=ea2e7110 task.ti=ea110000)
[42581.169031] Stack:
[42581.169031]  f8d48175 ea111de0 ea111b9c ea111c18 ea111bc4 f8d48be9 00000000 00001000
[42581.169031]  00000018 ea3fbc00 00000000 00000002 e9a6b078 00000000 00000000 00000078
[42581.169031]  00000000 f8d48b40 ea3fbc00 ea86a100 ea111c5c f83167e0 e9a6b065 e9a6b05d
[42581.169031] Call Trace:
[42581.169031]  [<f8d48175>] ? encode_getattr_two+0x25/0x60 [nfs]
[42581.169031]  [<f8d48be9>] nfs4_xdr_enc_getacl+0xa9/0xd0 [nfs]
[42581.169031]  [<f8d48b40>] ? nfs4_xdr_enc_fs_locations+0xd0/0xd0 [nfs]
[42581.169031]  [<f83167e0>] gss_wrap_req+0xb0/0x410 [auth_rpcgss]
[42581.169031]  [<f7f3c4c5>] ? xdr_encode_opaque_fixed+0x65/0x70 [sunrpc]
[42581.169031]  [<f8316e37>] ? gss_marshal+0xf7/0x180 [auth_rpcgss]
[42581.169031]  [<f8d48b40>] ? nfs4_xdr_enc_fs_locations+0xd0/0xd0 [nfs]
[42581.169031]  [<f7f3353c>] rpcauth_wrap_req+0x4c/0xc0 [sunrpc]
[42581.169031]  [<f8316730>] ? simple_get_bytes.constprop.6+0x30/0x30 [auth_rpcgss]
[42581.169031]  [<f7f3343a>] ? rpcauth_marshcred+0x2a/0x70 [sunrpc]
[42581.169031]  [<f7f2cd84>] ? xprt_prepare_transmit+0x64/0xa0 [sunrpc]
[42581.169031]  [<c04f6533>] ? mempool_alloc_slab+0x13/0x20
[42581.169031]  [<f7f2ac7e>] call_transmit+0x14e/0x250 [sunrpc]
[42581.169031]  [<c04f66a0>] ? mempool_alloc+0x40/0xf0
[42581.169031]  [<f7f31ea2>] __rpc_execute+0x52/0x2a0 [sunrpc]
[42581.169031]  [<c047c773>] ? wake_up_bit+0x23/0x30
[42581.169031]  [<f7f325c8>] rpc_execute+0x38/0x40 [sunrpc]
[42581.169031]  [<f7f2b0a9>] rpc_run_task+0x59/0x70 [sunrpc]
[42581.169031]  [<f7f2b1bc>] rpc_call_sync+0x3c/0x60 [sunrpc]
[42581.169031]  [<f8d402d3>] _nfs4_call_sync+0x23/0x30 [nfs]
[42581.169031]  [<f8d3eff6>] __nfs4_get_acl_uncached+0x186/0x290 [nfs]
[42581.169031]  [<f8d42df4>] nfs4_xattr_get_nfs4_acl+0xd4/0x120 [nfs]
[42581.169031]  [<c055d3c6>] generic_getxattr+0x46/0x60
[42581.169031]  [<c055d380>] ? xattr_resolve_name+0x80/0x80
[42581.169031]  [<c055d920>] vfs_getxattr+0x80/0xb0
[42581.169031]  [<c055d9dc>] getxattr+0x8c/0x110
[42581.169031]  [<c054dc1a>] ? path_openat+0xca/0x350
[42581.169031]  [<c061051b>] ? inode_has_perm+0x3b/0x50
[42581.169031]  [<c054dfb1>] ? do_filp_open+0x31/0x80
[42581.169031]  [<c0664908>] ? strncpy_from_user+0x38/0x70
[42581.169031]  [<c054a1cb>] ? putname+0x2b/0x40
[42581.169031]  [<c054a1cb>] ? putname+0x2b/0x40
[42581.169031]  [<c04b2fe1>] ? audit_syscall_entry+0x1e1/0x2c0
[42581.169031]  [<c04b3306>] ? audit_syscall_exit+0x176/0x1a0
[42581.169031]  [<c041cc72>] ? syscall_trace_enter+0x172/0x1d0
[42581.169031]  [<c055e2d6>] sys_fgetxattr+0x46/0x70
[42581.169031]  [<c093c4e4>] syscall_call+0x7/0xb
[42581.169031] Code: ff 8b 4d e0 89 fa e8 20 a8 01 00 e9 d0 fd ff ff 0f 0b 90 90 90 90 90 90 90 90 90 55 89 e5 57 56 53 83 ec 04 3e 8d 74 26 00 89 c7 <8b> 00 c1 e8 1e 69 c0 40 03 00 00 05 c0 fb ba c0 2b 80 0c 03 00 
[42581.169031] EIP: [<c0510330>] page_address+0x10/0xe0 SS:ESP 0068:ea111b74
[42581.169031] CR2: 0000000000000000
[42581.189890] ---[ end trace f91c7b7383bd68a9 ]---
[42808.289329] [drm:radeon_cs_ioctl] *ERROR* Failed to parse relocation -35!
[42874.816423] [drm:radeon_cs_ioctl] *ERROR* Failed to parse relocation -35!


Ran memtest overnight and no problems.  Somewhat similar report here:
http://www.spinics.net/lists/kernel/msg1289754.html

Version-Release number of selected component (if applicable):
3.2.3-2.fc16.i686.PAE

First time I've seen this on any machine here before.
Comment 1 Jeff Layton 2012-02-08 18:36:01 UTC 
There's already a proposed fix in the context of this thread, and I expect
that it'll make its way to stable once Trond merges it:

    http://www.spinics.net/lists/linux-nfs/msg27246.html
Comment 2 Orion Poplawski 2012-02-22 18:38:48 UTC 
Looks like Dave Jones applied to 3.2.7-1.f17.  Testing that out...
Comment 3 Orion Poplawski 2012-02-22 19:15:41 UTC 
Yup, appears to be fixed there.  Update is getting pushed to stable.