[regression] kernel oops when mounting NFSv4 filesystem

[chuinker]

problem manifests after upgrade to 2.6.22-14-386

from syslog:

Dec 20 01:30:27 localhost kernel: [19675.421968] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000051
Dec 20 01:30:27 localhost kernel: [19675.421977] printing eip:
Dec 20 01:30:27 localhost kernel: [19675.421979] f8dd186c
Dec 20 01:30:27 localhost kernel: [19675.421980] *pde = 00000000
Dec 20 01:30:27 localhost kernel: [19675.421983] Oops: 0000 [#66]
Dec 20 01:30:27 localhost kernel: [19675.421985] Modules linked in: binfmt_misc ppdev parport_pc lp parport i915 drm autofs4 speedstep_lib cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_ondemand freq_table cpufreq_conservative video sbs button dock container ac battery nfs lockd sunrpc snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd soundcore pcspkr snd_page_alloc usbhid hid rtc usblp shpchp pci_hotplug iTCO_wdt iTCO_vendor_support intel_agp agpgart ipv6 evdev ext3 jbd mbcache sg sr_mod cdrom sd_mod 8139too ata_piix ohci1394 ieee1394 8139cp mii ata_generic libata scsi_mod ehci_hcd uhci_hcd usbcore raid10 raid456 xor raid1 raid0 multipath linear md_mod dm_mirror dm_snapshot dm_mod thermal processor fan fuse apparmor commoncap
Dec 20 01:30:27 localhost kernel: [19675.422043] CPU: 0
Dec 20 01:30:27 localhost kernel: [19675.422044] EIP: 0060:[<f8dd186c>] Not tainted VLI
Dec 20 01:30:27 localhost kernel: [19675.422045] EFLAGS: 00010282 (2.6.22-14-386 #1)
Dec 20 01:30:27 localhost kernel: [19675.422066] EIP is at nfs_compare_super+0x3c/0xe0 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.422069] eax: 00000041 ebx: f0dbb200 ecx: 00000010 edx: cbd7222c
Dec 20 01:30:27 localhost kernel: [19675.422072] esi: dbbf1cbc edi: 00000051 ebp: cbd72200 esp: eee4dcb8
Dec 20 01:30:27 localhost automount[9232]: mount(generic): failed to mount nerferter:/corey (type nfs4) on /var/autofs/local/nerf
Dec 20 01:30:27 localhost kernel: [19675.422074] ds: 007b es: 007b fs: 0000 gs: 0033 ss: 0068
Dec 20 01:30:27 localhost automount[9232]: failed to mount /var/autofs/local/nerf
Dec 20 01:30:27 localhost kernel: [19675.422077] Process mount.nfs4 (pid: 9234, ti=eee4c000 task=ef4bc000 task.ti=eee4c000)
Dec 20 01:30:27 localhost kernel: [19675.422079] Stack: f0dbb800 00000041 cbd7222c f0dbb898 f0dbb800 00000000 f363e580 c016be14
Dec 20 01:30:27 localhost kernel: [19675.422085] f8e01e98 f8dd17f0 f8dd1830 f8e01e80 ef1dcc00 ef1dcc00 f8e01e80 f363e580
Dec 20 01:30:27 localhost kernel: [19675.422090] f8dd243d ef1dcc00 eee4dda0 00000001 eee4dd1e f7db6f08 f76c9b20 f76c9b20
Dec 20 01:30:27 localhost kernel: [19675.422095] Call Trace:
Dec 20 01:30:27 localhost kernel: [19675.422111] [sget+84/704] sget+0x54/0x2c0
Dec 20 01:30:27 localhost kernel: [19675.422121] [<f8dd17f0>] nfs_set_super+0x0/0x40 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.422132] [<f8dd1830>] nfs_compare_super+0x0/0xe0 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.422152] [<f8dd243d>] nfs4_get_sb+0x25d/0x370 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.422264] [vfs_kern_mount+182/304] vfs_kern_mount+0xb6/0x130
Dec 20 01:30:27 localhost kernel: [19675.422286] [do_kern_mount+63/240] do_kern_mount+0x3f/0xf0
Dec 20 01:30:27 localhost kernel: [19675.422301] [do_mount+1590/1776] do_mount+0x636/0x6f0
Dec 20 01:30:27 localhost kernel: [19675.422325] [tcp_v4_send_check+68/240] tcp_v4_send_check+0x44/0xf0
Dec 20 01:30:27 localhost kernel: [19675.422341] [tcp_transmit_skb+1003/2032] tcp_transmit_skb+0x3eb/0x7f0
Dec 20 01:30:27 localhost kernel: [19675.422347] [sock_aio_read+287/304] sock_aio_read+0x11f/0x130
Dec 20 01:30:27 localhost kernel: [19675.422364] [__handle_mm_fault+1026/2560] __handle_mm_fault+0x402/0xa00
Dec 20 01:30:27 localhost kernel: [19675.422383] [<f88aca3f>] rtl8139_interrupt+0x15f/0x480 [8139too]
Dec 20 01:30:27 localhost kernel: [19675.422421] [do_page_fault+892/1680] do_page_fault+0x37c/0x690
Dec 20 01:30:27 localhost kernel: [19675.422462] [error_code+106/112] error_code+0x6a/0x70
Dec 20 01:30:27 localhost kernel: [19675.422478] [drain_local_pages+75/176] drain_local_pages+0x4b/0xb0
Dec 20 01:30:27 localhost kernel: [19675.422485] [km_report+64/128] km_report+0x40/0x80
Dec 20 01:30:27 localhost kernel: [19675.422491] [copy_mount_options+171/336] copy_mount_options+0xab/0x150
Dec 20 01:30:27 localhost kernel: [19675.422513] [sys_mount+114/176] sys_mount+0x72/0xb0
Dec 20 01:30:27 localhost kernel: [19675.422530] [sysenter_past_esp+107/169] sysenter_past_esp+0x6b/0xa9
Dec 20 01:30:27 localhost kernel: [19675.422568] =======================
Dec 20 01:30:27 localhost kernel: [19675.422569] Code: 74 24 10 89 6c 24 18 89 04 24 8b 2a 8b 52 04 8b 98 4c 01 00 00 fc 89 54 24 08 8b 45 00 89 44 24 04 8b 33 89 c7 83 c7 10 83 c6 10 <f3> a6 74 16 31 c0 8b 5c 24 0c 8b 74 24 10 8b 7c 24 14 8b 6c 24
Dec 20 01:30:27 localhost kernel: [19675.422591] EIP: [<f8dd186c>] nfs_compare_super+0x3c/0xe0 [nfs] SS:ESP 0068:eee4dcb8
Dec 20 01:30:27 localhost kernel: [19675.470854] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000052
Dec 20 01:30:27 localhost kernel: [19675.470862] printing eip:
Dec 20 01:30:27 localhost kernel: [19675.470864] f8dd186c
Dec 20 01:30:27 localhost kernel: [19675.470865] *pde = 00000000
Dec 20 01:30:27 localhost kernel: [19675.470869] Oops: 0000 [#67]
Dec 20 01:30:27 localhost kernel: [19675.470871] Modules linked in: binfmt_misc ppdev parport_pc lp parport i915 drm autofs4 speedstep_lib cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_ondemand freq_table cpufreq_conservative video sbs button dock container ac battery nfs lockd sunrpc snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd soundcore pcspkr snd_page_alloc usbhid hid rtc usblp shpchp pci_hotplug iTCO_wdt iTCO_vendor_support intel_agp agpgart ipv6 evdev ext3 jbd mbcache sg sr_mod cdrom sd_mod 8139too ata_piix ohci1394 ieee1394 8139cp mii ata_generic libata scsi_mod ehci_hcd uhci_hcd usbcore raid10 raid456 xor raid1 raid0 multipath linear md_mod dm_mirror dm_snapshot dm_mod thermal processor fan fuse apparmor commoncap
Dec 20 01:30:27 localhost kernel: [19675.470927] CPU: 0
Dec 20 01:30:27 localhost kernel: [19675.470928] EIP: 0060:[<f8dd186c>] Not tainted VLI
Dec 20 01:30:27 localhost kernel: [19675.470929] EFLAGS: 00010282 (2.6.22-14-386 #1)
Dec 20 01:30:27 localhost kernel: [19675.470952] EIP is at nfs_compare_super+0x3c/0xe0 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.470954] eax: 00000042 ebx: f0dbb200 ecx: 00000010 edx: cbd7222c
Dec 20 01:30:27 localhost kernel: [19675.470957] esi: dbbf1cbc edi: 00000052 ebp: cbd72200 esp: eec5fcb8
Dec 20 01:30:27 localhost automount[9235]: mount(generic): failed to mount nerferter:/corey (type nfs4) on /var/autofs/local/nerf
Dec 20 01:30:27 localhost kernel: [19675.470959] ds: 007b es: 007b fs: 0000 gs: 0033 ss: 0068
Dec 20 01:30:27 localhost automount[9235]: failed to mount /var/autofs/local/nerf
Dec 20 01:30:27 localhost kernel: [19675.470962] Process mount.nfs4 (pid: 9272, ti=eec5e000 task=ef111440 task.ti=eec5e000)
Dec 20 01:30:27 localhost kernel: [19675.470964] Stack: f0dbb800 00000042 cbd7222c f0dbb898 f0dbb800 00000000 f363ef00 c016be14
Dec 20 01:30:27 localhost kernel: [19675.470970] f8e01e98 f8dd17f0 f8dd1830 f8e01e80 ddd0e540 ddd0e540 f8e01e80 f363ef00
Dec 20 01:30:27 localhost kernel: [19675.470975] f8dd243d ddd0e540 eec5fda0 00000001 eec5fd1e f7db6f10 f76c9060 f76c9060
Dec 20 01:30:27 localhost kernel: [19675.470980] Call Trace:
Dec 20 01:30:27 localhost kernel: [19675.470995] [sget+84/704] sget+0x54/0x2c0
Dec 20 01:30:27 localhost kernel: [19675.471005] [<f8dd17f0>] nfs_set_super+0x0/0x40 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.471016] [<f8dd1830>] nfs_compare_super+0x0/0xe0 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.471036] [<f8dd243d>] nfs4_get_sb+0x25d/0x370 [nfs]
Dec 20 01:30:27 localhost kernel: [19675.471147] [vfs_kern_mount+182/304] vfs_kern_mount+0xb6/0x130
Dec 20 01:30:27 localhost kernel: [19675.471170] [do_kern_mount+63/240] do_kern_mount+0x3f/0xf0
Dec 20 01:30:27 localhost kernel: [19675.471184] [do_mount+1590/1776] do_mount+0x636/0x6f0
Dec 20 01:30:27 localhost kernel: [19675.471218] [ack_ioapic_quirk_irq+66/176] ack_ioapic_quirk_irq+0x42/0xb0
Dec 20 01:30:27 localhost kernel: [19675.471241] [__handle_mm_fault+1026/2560] __handle_mm_fault+0x402/0xa00
Dec 20 01:30:27 localhost kernel: [19675.471257] [common_interrupt+35/48] common_interrupt+0x23/0x30
Dec 20 01:30:27 localhost kernel: [19675.471293] [do_page_fault+892/1680] do_page_fault+0x37c/0x690
Dec 20 01:30:27 localhost kernel: [19675.471334] [error_code+106/112] error_code+0x6a/0x70
Dec 20 01:30:27 localhost kernel: [19675.471351] [pipe_read_fasync+107/112] pipe_read_fasync+0x6b/0x70
Dec 20 01:30:27 localhost kernel: [19675.471356] [km_report+64/128] km_report+0x40/0x80
Dec 20 01:30:27 localhost kernel: [19675.471362] [copy_mount_options+171/336] copy_mount_options+0xab/0x150
Dec 20 01:30:27 localhost kernel: [19675.471385] [sys_mount+114/176] sys_mount+0x72/0xb0
Dec 20 01:30:27 localhost kernel: [19675.471402] [sysenter_past_esp+107/169] sysenter_past_esp+0x6b/0xa9
Dec 20 01:30:27 localhost kernel: [19675.471439] =======================
Dec 20 01:30:27 localhost kernel: [19675.471440] Code: 74 24 10 89 6c 24 18 89 04 24 8b 2a 8b 52 04 8b 98 4c 01 00 00 fc 89 54 24 08 8b 45 00 89 44 24 04 8b 33 89 c7 83 c7 10 83 c6 10 <f3> a6 74 16 31 c0 8b 5c 24 0c 8b 74 24 10 8b 7c 24 14 8b 6c 24
Dec 20 01:30:27 localhost kernel: [19675.471463] EIP: [<f8dd186c>] nfs_compare_super+0x3c/0xe0 [nfs] SS:ESP 0068:eec5fcb8

[Nathaniel W. Turner (nturner)]

I have an NFS-mounted /home, and this causes a failure to boot after upgrade to the latest Hardy kernel. I see similar oopses, as well as oopses with an EIP in nfs_fhget.

[Nathaniel W. Turner (nturner)]

...and by "Hardy", I of course mean "Gutsy".

[Nathaniel W. Turner (nturner)]

To be more specific, this bug occurs with linux-image-2.6.22-14-generic_2.6.22-14.47_i386 --- downgrading to version 2.6.22-14.46 restores normal operation.

[Nathaniel W. Turner (nturner)]

The original reporter and I are both using NFSv4. I have not tried to reproduce this with NFSv3.

[chuinker (corey-corlogic)]

it seems to have been identified by the

https://bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/148600

and more specifically, here

https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/164231

In the mean time, I've been able to work around the problem by doing static (non-autofs) mounts.

[Launchpad Janitor (janitor)]

Beginning with the Hardy Heron 8.04 development cycle, all open Ubuntu kernel bugs need to be reported against the "linux" kernel package. We are automatically migrating this bug to the new "linux" package. However, development has already began for the upcoming Intrepid Ibex 8.10 release. It would be helpful if you could test the upcoming release and verify if this is still an issue - http://www.ubuntu.com/testing . If the issue still exists, please update this report by changing the Status of the "linux" task from "Incomplete" to "New". We appreciate your patience and understanding as we make this transition. Thanks!