vfs_setlease での null ポインター逆参照中にカーネルがクラッシュする

Issue

• vfs_setlease での null ポインター逆参照中にカーネルがクラッシュします。
• カーネルパニックが発生し、BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 というメッセージが表示されます。

Jan 23 10:41:36 hostname kernel: WARNING: CPU: 33 PID: 939775 at fs/nfsd/nfs4state.c:5270 laundromat_main+0x33e/0x6d0 [nfsd]
Jan 23 10:41:36 hostname kernel: Modules linked in: rpcsec_gss_krb5 md4 sha512_ssse3 sha512_generic cmac nls_utf8 cifs libarc4 dns_resolver nfsd auth_rpcgss nfs_acl lockd grace rpcrdma ib_isert iscsi_target_mod ib_iser ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core overlay tcp_diag udp_diag raw_diag inet_diag mmfs26(OE) mmfslinux(OE) tracedev(OE) xt_conntrack nft_counter xt_REDIRECT nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink dm_round_robin sd_mod iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi sunrpc vfat fat ext4 mbcache jbd2 dm_multipath intel_rapl_msr intel_rapl_common isst_if_common nfit libnvdimm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel iTCO_wdt iTCO_vendor_support intel_rapl_perf joydev pcspkr lpc_ich i2c_i801 virtio_balloon binfmt_misc ip_tables xfs libcrc32c sr_mod cdrom sg ahci libahci crc32c_intel serio_raw libata qxl drm_ttm_helper ttm drm_kms_helper syscopyarea
Jan 23 10:41:36 hostname kernel:  sysfillrect sysimgblt fb_sys_fops virtio_blk drm virtio_console virtio_net net_failover failover dm_mirror dm_region_hash dm_log dm_mod
Jan 23 10:41:36 hostname kernel: CPU: 5 PID: 1387908 Comm: kworker/u128:2 Kdump: loaded Tainted: G        W  OE    --------- -  - 4.18.0-240.1.1.el8_3.x86_64 #1
Jan 23 10:41:36 hostname kernel: Hardware name: Red Hat RHEL/RHEL-AV, BIOS 0.0.0 02/06/2015
Jan 23 10:41:36 hostname kernel: Workqueue: nfsd4 laundromat_main [nfsd]
Jan 23 10:41:36 hostname kernel: RIP: 0010:laundromat_main+0x33e/0x6d0 [nfsd]
Jan 23 10:41:36 hostname kernel: Code: 49 8b 16 4c 39 74 24 18 74 24 49 8b 46 20 49 8d 7e a8 4d 89 f7 49 39 c4 0f 8c 46 03 00 00 49 89 d6 e8 46 df ff ff 84 c0 75 af <0f> 0b eb ab 48 8b 5c 24 28 48 c7 c7 40 7b 05 c1 e8 7d 45 2f d3 66
Jan 23 10:41:36 hostname kernel: RSP: 0018:ffffa6c5cdcf7e10 EFLAGS: 00010246
Jan 23 10:41:36 hostname kernel: RAX: 0000000000000000 RBX: ffff8e5f2216a4d8 RCX: ffffffff96087080
Jan 23 10:41:36 hostname kernel: RDX: ffff8e5db40af0b0 RSI: 0000000000000000 RDI: ffff8e5db40af078
Jan 23 10:41:36 hostname kernel: RBP: ffffa6c5cdcf7e50 R08: 0000000000000000 R09: ffff8e5f2216a498
Jan 23 10:41:36 hostname kernel: R10: 8080808080808080 R11: 0000000000000000 R12: 000000000007c686
Jan 23 10:41:36 hostname kernel: R13: 000000000000005a R14: ffff8e5f2216a4b8 R15: ffff8e5db40af0d0
Jan 23 10:41:36 hostname kernel: FS:  0000000000000000(0000) GS:ffff8e631ed40000(0000) knlGS:0000000000000000
Jan 23 10:41:36 hostname kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jan 23 10:41:36 hostname kernel: CR2: 00007f801aa59030 CR3: 000000077800a001 CR4: 00000000007606e0
Jan 23 10:41:36 hostname kernel: PKRU: 55555554
Jan 23 10:41:36 hostname kernel: Call Trace:
Jan 23 10:41:36 hostname kernel:  process_one_work+0x1a7/0x360
Jan 23 10:41:36 hostname kernel:  worker_thread+0x30/0x390
Jan 23 10:41:36 hostname kernel:  ? create_worker+0x1a0/0x1a0
Jan 23 10:41:36 hostname kernel:  kthread+0x112/0x130
Jan 23 10:41:36 hostname kernel:  ? kthread_flush_work_fn+0x10/0x10
Jan 23 10:41:36 hostname kernel:  ret_from_fork+0x35/0x40
Jan 23 10:41:36 hostname kernel: ---[ end trace e398cc78e1473e66 ]---
Jan 23 10:41:36 hostname kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000028