oops with umount -lf of krb5 NFS mount.

[Alex Polvi]

This is a follow-up on a thread started by a co-worker. The following
is a script that will consistently oops a nfsv3 krb5 automount, along
with the oops that it causes.

Here is a possible patch, but I have not tested it:
http://permalink.gmane.org/gmane.linux.nfs/6565

This script does not work after mounting the identical non-krb5 share.

Can anyone use this to recreate the panic? Note the use of umount...
adjust accordingly. This was tested on 2.6.16 and 2.6.13.

The share/automounter:

automount(pid7393) on /home type autofs
(rw,fd=4,pgrp=7393,minproto=2,maxproto=4)
nfshost:/share/cdh on /home/cdhtest type nfs
(rw,nosuid,sec=krb5,tcp,rsize=8192,wsize=8192,intr,bg,addr=12.34.56.78)

polvi at return:~$ cat oopsmynfs.sh
#!/bin/bash

PROG=${0##*/}

function usage {
  cat <<EOF
usage: $PROG /nfs/path/

will oops sunrpc using the nfs host that serves /nfs/path/
EOF
  exit 1
}

DIR=$1

[ -d "$DIR" ] || usage

ls $DIR &> /dev/null # get the directory automounted

echo "Make the nfs server unusable by the client (turn off nfs, iptables, etc)."
echo "press enter when ready"
read a

# if the echo is hit, this script failed to oops sunrpc
(cd /; cd $DIR/$RANDOM 2> /dev/null; echo "could not oops") &
(stat "$LOCALPATH/$RANDOM-$PROG-testfile" &> /dev/null) &
pid=$!
sleep 1
kill -TERM $pid 2> /dev/null
sudo umount -lf $DIR

echo "Turn the nfs server back on and watch for the oops.  Should not
take more then 10s"

polvi at return:~$ cat oopmynfs-oops.out
net/sunrpc/rpc_pipe.c: rpc_lookup_parent failed to find path /nfs/clnt2/krb5
Unable to handle kernel NULL pointer dereference at virtual address 00000068
  printing eip:
c02b6243
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: des binfmt_misc rfcomm l2cap bluetooth acpi_cpufreq
cpufreq_userspace cpufreq_ondemand cpufreq_powersave nfsd exportfs
autofs4 video button battery container ac nfs lockd af_packet
hw_random snd_hda_intel snd_hda_codec snd_pcm_oss snd_mixer_oss
snd_pcm snd_timer snd soundcore snd_page_alloc shpchp pci_hotplug vfat
fat dm_mod nvidia agpgart psmouse mousedev parport_pc lp parport
ide_disk rpcsec_gss_krb5 auth_rpcgss sunrpc md_mod ext3 jbd mbcache
thermal processor fan usb_storage usbhid tg3 ehci_hcd uhci_hcd usbcore
sd_mod ide_cd cdrom ide_generic ata_piix libata scsi_mod piix generic
ide_core unix
CPU:    0
EIP:    0060:[<c02b6243>]    Tainted: P      VLI
EFLAGS: 00010296   (2.6.16.11-gg1 #1)
EIP is at _spin_lock+0x3/0x20
eax: 00000068   ebx: df9bf700   ecx: f6ff7d00   edx: 00000000
esi: 00000000   edi: f8957724   ebp: f6ff7cc4   esp: f6ff7cc4
ds: 007b   es: 007b   ss: 0068
Process oopsmynfs.sh (pid: 8318, threadinfo=f6ff6000 task=f6850550)
Stack: <0>f6ff7ce0 f894eb90 df9bf700 00000068 df9bf700 df9bf87c
f8957724 f6ff7d14
       f8b8b65e df9bf700 f6ff7d00 f894ebe0 ffffffe0 f6f7b9d8 df9bf774 f6ff7d00
       f6ff7d00 f6f7b8d0 f6f7ba10 f6f7b954 f6ff7d74 f8b8bf5f df9bf700 f6f7b954
Call Trace:
 [<c0103e0a>] show_stack_log_lvl+0xaa/0xe0
 [<c010402b>] show_registers+0x19b/0x210
 [<c0104249>] die+0x109/0x1a0
 [<c011624a>] do_page_fault+0x3ba/0x5b1
 [<c0103a33>] error_code+0x4f/0x54
 [<f894eb90>] gss_pipe_release+0x20/0x70 [auth_rpcgss]
  [<f8b8b65e>] rpc_close_pipes+0x13e/0x140 [sunrpc]
  [<f8b8bf5f>] rpc_depopulate+0xaf/0x120 [sunrpc]
  [<f8b8c4c3>] rpc_rmdir+0x73/0xb0 [sunrpc]
  [<f8b7b64d>] rpc_destroy_client+0x9d/0xf0 [sunrpc]
  [<f8b7b630>] rpc_destroy_client+0x80/0xf0 [sunrpc]
  [<f8b7b54d>] rpc_shutdown_client+0xdd/0x140 [sunrpc]
  [<f8d0bc08>] nfs_kill_super+0x78/0xd0 [nfs]
 [<c016d6da>] deactivate_super+0x7a/0xb0
 [<c0185060>] mntput_no_expire+0x50/0x80
 [<c01752da>] path_release+0x2a/0x30
 [<c0170da7>] vfs_stat_fd+0x57/0x70
 [<c0170de0>] vfs_stat+0x20/0x30
 [<c0171559>] sys_stat64+0x19/0x40
 [<c0102eb3>] sysenter_past_esp+0x54/0x75
Code: 21 e2 81 42 14 00 01 00 00 f0 81 28 00 00 00 01 74 05 e8 fd d9
ff ff 5d c3 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 <f0>
fe 08 79 09 f3 90 80 38 00 7e f9 eb f2 5d c3 8d b6 00 00 00
  BUG: oopsmynfs.sh/8318, lock held at task exit time!
 [c2ae96f4] {inode_init_once}
.. held by:      oopsmynfs.sh: 8318 [f6850550, 116]
... acquired at:               rpc_rmdir+0x47/0xb0 [sunrpc]