Comment 0 for bug 253004

Having setup an nfsv4 export in /etc/exports:

/store /192.168.20.0/24(rw,async,no_root_squash,no_subtree_check,fsid=0)

I restarted the nfs-kernel-server service:

# /etc/init.d/nfs-kernel-server stop
# /etc/init.d/nfs-kernel-server start

After ~15s, we see the callback being attempted twice and an oops:

[ 2361.807753] nfs4_cb: server 194.202.174.13 not responding, timed out
[ 2361.808059] nfs4_cb: server 194.202.174.13 not responding, timed out
[ 2361.808085] Unable to handle kernel NULL pointer dereference at 0000000000000018 RIP:
[ 2361.808098] [<ffffffff8830d285>] :sunrpc:rpc_shutdown_client+0x25/0xf0
[ 2361.808140] PGD 7dfb7067 PUD 7dfae067 PMD 0
[ 2361.808155] Oops: 0000 [1] SMP
[ 2361.808166] CPU 1
[ 2361.808174] Modules linked in: nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs ipv6 ac sbs sbshc battery dock video output iptable_filter ip_tables x_tables xfs parport_pc lp parport af_packet loop container serio_raw cfi_cmdset_0002 cfi_util jedec_probe button cfi_probe gen_probe ck804xrom mtd chipreg shpchp pci_hotplug k8temp i2c_nforce2 map_funcs psmouse i2c_core evdev pcspkr ext3 jbd mbcache sg sd_mod pata_acpi sata_nv tg3 ata_generic pata_amd libata scsi_mod ehci_hcd ohci_hcd usbcore thermal processor fan fbcon tileblit font bitblit softcursor fuse
[ 2361.808369] Pid: 5877, comm: nfs4_cb_probe Not tainted 2.6.24-19-generic #1
[ 2361.808380] RIP: 0010:[<ffffffff8830d285>] [<ffffffff8830d285>] :sunrpc:rpc_shutdown_client+0x25/0xf0
[ 2361.808404] RSP: 0018:ffff81007dff3ea0 EFLAGS: 00010246
[ 2361.808412] RAX: 00000000fffffffb RBX: ffff81007b9dac00 RCX: ffff810001019480
[ 2361.808424] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
[ 2361.808435] RBP: 0000000000000018 R08: ffffffff8833a490 R09: ffff81007b9c2000
[ 2361.808446] R10: 0000000000000000 R11: ffffffff80287840 R12: 0000000000000000
[ 2361.808471] R13: 0000000000000000 R14: ffff81007dff3eb8 R15: 0000000000000000
[ 2361.808496] FS: 00007fcf7f91a6e0(0000) GS:ffff81007dc01700(0000) knlGS:0000000000000000
[ 2361.808533] CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
[ 2361.808556] CR2: 0000000000000018 CR3: 000000007dfb6000 CR4: 00000000000006e0
[ 2361.808580] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2361.808605] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 2361.808630] Process nfs4_cb_probe (pid: 5877, threadinfo ffff81007dff2000, task ffff81007df68fc0)
[ 2361.808668] Stack: 0000000000000000 0000000000000000 0000000000000282 0000000000000282
[ 2361.808713] ffff81007d5bd180 ffffffff88313459 ffff81007b9dac00 ffff81007b9dac00
[ 2361.808755] ffffffff883888f0 0000000000000000 0000000000000000 ffffffff8838895c
[ 2361.808784] Call Trace:
[ 2361.808829] [<ffffffff88313459>] :sunrpc:rpc_put_task+0x99/0xc0
[ 2361.808871] [<ffffffff883888f0>] :nfsd:do_probe_callback+0x0/0x80
[ 2361.808901] [<ffffffff8838895c>] :nfsd:do_probe_callback+0x6c/0x80
[ 2361.808931] [<ffffffff8025363b>] kthread+0x4b/0x80
[ 2361.808957] [<ffffffff8020d198>] child_rip+0xa/0x12
[ 2361.808984] [<ffffffff802535f0>] kthread+0x0/0x80
[ 2361.809006] [<ffffffff8020d18e>] child_rip+0x0/0x12
[ 2361.809028]
[ 2361.809044]
[ 2361.809044] Code: 49 39 6c 24 18 0f 84 84 00 00 00 4c 89 e7 e8 88 67 00 00 49
[ 2361.809132] RIP [<ffffffff8830d285>] :sunrpc:rpc_shutdown_client+0x25/0xf0
[ 2361.809165] RSP <ffff81007dff3ea0>
[ 2361.809185] CR2: 0000000000000018
[ 2361.809493] ---[ end trace 949da475918d45ed ]---

likely related to: #212485 kernel bug rpc nfs client.

Fixed apparently [http://linux-nfs.org/pipermail/nfsv4/2008-April/008441.html] by:

commit 63c86716ea34ad94d52e5b0abbda152574dc42b5 "nfsd: move callback rpc_client creation into separate thread":
commit 46f8a64bae11f5c9b15b4401f6e9863281999b66 "nfsd4: probe callback channel only once":

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=63c86716ea34ad94d52e5b0abbda152574dc42b5
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=46f8a64bae11f5c9b15b4401f6e9863281999b66