RHEL6 で inotify_rm_watch syscall を行うと RIP generic_detach_inode、gvfsd-trash でクラッシュする

Issue

• カーネルがクラッシュし、generic_detach_inode に以下のバックトレースが発生します。

general protection fault:0000 [#1] SMP 
last sysfs file:/sys/devices/pci0000:00/0000:0:17.0/0000:13:00.0/local_cpus
CPU 0 
Modules linked in: linuxshield(U) lshook(U) fuse vsock(U) vmci(U) nfs lockd fscache auth_rpcgss nfs_acl sunrpc autofs4 ipv6 uinput ppdev vmware_balloon microcode parport_pc parport sg i2c_piix4 i2c_core shpchp ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom vmxnet3 vmw_pvscsi pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: linuxshield]

Pid:21579, comm: gvfsd-trash Not tainted 2.6.32-431.1.2.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP:0010:[<ffffffff811a5384>]  [<ffffffff811a5384>] generic_detach_inode+0xe4/0x1f0
RSP:0018:ffff88012defde78  EFLAGS:00010282
RAX: ffff8801028c9418 RBX: ffff8801028c9408 RCX: dead000000100100
RDX: dead000000200200 RSI: ffff8801028c9620 RDI: ffffffff81fcf800
RBP: ffff88012defde98 R08:4040000000000000 R09: fedf73aa83058808
R10:00000000000000a0 R11:7fffffffffffffff R12: ffffffff81fcf800
R13: ffff880097fbc800 R14: ffff880132023630 R15: ffff88013913a238
FS:00007f189f88b7a0(0000) GS:ffff88002be00000(0000) knlGS:0000000000000000
CS:0010 DS:0000 ES:0000 CR0:0000000080050033
CR2:00007f189f8a9000 CR3:00000001011f0000 CR4:00000000000007f0
DR0:0000000000000000 DR1:0000000000000000 DR2:0000000000000000
DR3:0000000000000000 DR6:00000000ffff0ff0 DR7:0000000000000400
...
Call Trace:
 [<ffffffff811a63fd>] generic_drop_inode+0x1d/0x80
 [<ffffffff811a5292>] iput+0x62/0x70
 [<ffffffff811cce1c>] fsnotify_destroy_mark_by_entry+0x14c/0x1d0
 [<ffffffff811cf745>] sys_inotify_rm_watch+0x85/0xe0
 [<ffffffff810e1e6e>] ?__audit_syscall_exit+0x25e/0x290
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code:1e 48 8b 13 48 85 d2 48 89 10 74 04 48 89 42 08 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 4b 10 48 8b 53 18 48 8d 43 10 <48> 89 51 08 48 89 0a 48 8b 4b 20 48 8b 53 28 48 89 43 10 48 89 
RIP  [<ffffffff811a5384>] generic_detach_inode+0xe4/0x1f0
 RSP <ffff88012defde78>