Description of problem:

Two of our machines have been experiencing kernel panics every 9-10 days in dcache.h.  Both machines mount filesystems via NFSv4 from OpenSolaris and OpenIndiana systems, but I do not know if this is related.

Version-Release number of selected component (if applicable):

2.6.18-308.11.1.el5

How reproducible:

It's happened three times on once machine and twice on the other, but I do not yet have a way to reproduce it at will.


Additional info:

System info, backtrace, and log from crash(8):


      KERNEL: /usr/lib/debug/lib/modules/2.6.18-308.11.1.el5/vmlinux
    DUMPFILE: vmcore  [PARTIAL DUMP]
        CPUS: 2
        DATE: Sun Aug  5 16:46:39 2012
      UPTIME: 9 days, 03:19:28
LOAD AVERAGE: 1.09, 1.04, 1.01
       TASKS: 202
    NODENAME: dryas.ling.washington.edu
     RELEASE: 2.6.18-308.11.1.el5
     VERSION: #1 SMP Fri Jun 15 15:41:53 EDT 2012
     MACHINE: x86_64  (2205 Mhz)
      MEMORY: 7.9 GB
       PANIC: ""
         PID: 10391
     COMMAND: "df"
        TASK: ffff81013fb3c860  [THREAD_INFO: ffff810139c3e000]
         CPU: 1
       STATE: TASK_RUNNING (PANIC)

crash> bt
PID: 10391  TASK: ffff81013fb3c860  CPU: 1   COMMAND: "df"
 #0 [ffff810139c3fa90] crash_kexec at ffffffff800b09ac
 #1 [ffff810139c3fb50] __die at ffffffff80065137
 #2 [ffff810139c3fb90] die at ffffffff8006c789
 #3 [ffff810139c3fbc0] do_invalid_op at ffffffff8006cd49
 #4 [ffff810139c3fc80] error_exit at ffffffff8005dde9
    [exception RIP: __link_path_walk+2387]
    RIP: ffffffff8000a202  RSP: ffff810139c3fd38  RFLAGS: 00010246
    RAX: 0000000000000000  RBX: ffff810139c3fe48  RCX: 0000000000017c88
    RDX: ffff8101349d78e8  RSI: ffff8101c6003000  RDI: ffffffff80458580
    RBP: ffff8102328351c0   R8: 0000000000000001   R9: ffff8101438d7640
    R10: 0000000000000001  R11: ffffffff8002c578  R12: ffff8100b5bea3d8
    R13: 0000000000000000  R14: ffff8101c6003002  R15: 0000000000000002
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #5 [ffff810139c3fda0] link_path_walk at ffffffff8000eb23
 #6 [ffff810139c3fdd0] do_path_lookup at ffffffff8000cdf6
 #7 [ffff810139c3fe10] __user_walk_fd at ffffffff800239f8
 #8 [ffff810139c3fe40] vfs_stat_fd at ffffffff80028973
 #9 [ffff810139c3fef0] sys_newstat at ffffffff80023728
#10 [ffff810139c3ff80] tracesys at ffffffff8005d28d (via system_call)
    RIP: 0000003667cc4485  RSP: 00007fff97f2ec88  RFLAGS: 00000246
    RAX: ffffffffffffffda  RBX: ffffffff8005d28d  RCX: ffffffffffffffff
    RDX: 00007fff97f2ec90  RSI: 00007fff97f2ec90  RDI: 0000000000406be9
    RBP: 00007fff97f2edf0   R8: 0000000000000000   R9: 0000000009464acd
    R10: 0000000000000000  R11: 0000000000000246  R12: 00007fff97f2ec90
    R13: 00007fff97f2ed20  R14: 00007fff97f2edb0  R15: 0000000000000002
    ORIG_RAX: 0000000000000004  CS: 0033  SS: 002b
crash> log
Linux version 2.6.18-308.11.1.el5 (mockbuild.redhat.com) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Fri Jun 15 15:41:53 EDT 2012
Command line: ro root=LABEL=/ rhgb quiet crashkernel=128M@16M

[...trimmed...]

----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at include/linux/dcache.h:340
invalid opcode: 0000 [1] SMP 
last sysfs file: /devices/pci0000:00/0000:00:19.3/temp1_input
CPU 1 
Modules linked in: nfsd exportfs auth_rpcgss autofs4 hidp ip6table_filter ip6_tables iptable_raw xt_policy xt_multiport ipt_ULOG ipt_TTL ipt_ttl ipt_TOS ipt_tos ipt_TCPMSS ipt_SAME ipt_REJECT ipt_REDIRECT ipt_recent ipt_owner ipt_NETMAP ipt_MASQUERADE ipt_LOG ipt_iprange ipt_hashlimit ipt_ECN ipt_ecn ipt_DSCP ipt_dscp ipt_CLUSTERIP ipt_ah ipt_addrtype ip_nat_tftp ip_nat_snmp_basic ip_nat_pptp ip_nat_irc ip_nat_ftp ip_nat_amanda ip_conntrack_tftp ip_conntrack_pptp ip_conntrack_netbios_ns ip_conntrack_irc ip_conntrack_ftp ts_kmp ip_conntrack_amanda xt_tcpmss xt_pkttype xt_physdev bridge xt_NFQUEUE xt_MARK xt_mark xt_mac xt_limit xt_length xt_helper xt_dccp xt_conntrack xt_CONNMARK xt_connmark xt_CLASSIFY xt_tcpudp xt_state iptable_nat ip_nat ip_conntrack iptable_mangle nfnetlink iptable_filter ip_tables x_tables nfs nfs_acl rfcomm l2cap bluetooth lockd sunrpc be2iscsi ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp bnx2i cnic ipv6 xfrm_nalgo crypto_api uio cxgb3i libcxgbi cxgb3 8021q libiscsi_tcp libiscsi2 scsi_transport_iscsi2 scsi_transport_iscsi cpufreq_ondemand powernow_k8 freq_table mperf dm_mirror dm_multipath scsi_dh video backlight sbs power_meter i2c_ec dell_wmi wmi button battery asus_acpi acpi_memhotplug ac lp sg floppy pcspkr tg3 parport_pc k8_edac k8temp parport edac_mc hwmon ide_cd i2c_amd8111 tpm_tis tpm cdrom serio_raw tpm_bios i2c_amd756 i2c_core amd_rng dm_raid45 dm_message dm_region_hash dm_log dm_mod dm_mem_cache sata_mv libata shpchp 3w_xxxx sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 10391, comm: df Not tainted 2.6.18-308.11.1.el5 #1
RIP: 0010:[<ffffffff8000a202>]  [<ffffffff8000a202>] __link_path_walk+0x953/0xf25
RSP: 0018:ffff810139c3fd38  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff810139c3fe48 RCX: 0000000000017c88
RDX: ffff8101349d78e8 RSI: ffff8101c6003000 RDI: ffffffff80458580
RBP: ffff8102328351c0 R08: 0000000000000001 R09: ffff8101438d7640
R10: 0000000000000001 R11: ffffffff8002c578 R12: ffff8100b5bea3d8
R13: 0000000000000000 R14: ffff8101c6003002 R15: 0000000000000002
FS:  00002b3e6e9a8af0(0000) GS:ffff810143906a40(0000) knlGS:00000000f78b7b90
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000007238038 CR3: 0000000158964000 CR4: 00000000000006e0
Process df (pid: 10391, threadinfo ffff810139c3e000, task ffff81013fb3c860)
Stack:  ffff810139c3fde8 0000000100000000 0000000200017c88 ffff8101c6003000
 ffff8102312cb760 0000000000000000 ffff810139c3fed8 ffff8100b5bea3d8
 ffff810139c3fe48 ffff810104696980 0000000000000001 ffff8101c6003000
Call Trace:
 [<ffffffff8000eb23>] link_path_walk+0x45/0xb8
 [<ffffffff8000cdf6>] do_path_lookup+0x294/0x310
 [<ffffffff80012955>] getname+0x15b/0x1c2
 [<ffffffff800239f8>] __user_walk_fd+0x37/0x4c
 [<ffffffff80028973>] vfs_stat_fd+0x1b/0x4a
 [<ffffffff8000d543>] dput+0x2c/0x114
 [<ffffffff8002cafd>] mntput_no_expire+0x19/0x89
 [<ffffffff800471f6>] sys_chdir+0x55/0x62
 [<ffffffff80023728>] sys_newstat+0x19/0x31
 [<ffffffff8005d229>] tracesys+0x71/0xe0
 [<ffffffff8005d28d>] tracesys+0xd5/0xe0


Code: 0f 0b 68 80 bb 2b 80 c2 54 01 eb fe f0 ff 02 48 89 13 c7 05 
RIP  [<ffffffff8000a202>] __link_path_walk+0x953/0xf25
 RSP <ffff810139c3fd38>