RHEL6.4 / RHEL6.5 / RHEL7.0 : NFS client kernel panics with "kernel BUG at fs/locks.c:2037!" in locks_remove_flock

Issue

• Untainted kernel panic occurs on NFS client with following stack trace:

kernel BUG at fs/locks.c:2037!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:0a.0/0000:05:00.1/host8/rport-8:0-2/target8:0:0/8:0:0:165/state
CPU 2
Modules linked in: iptable_filter ip_tables ktap_57263(U) mptctl mptbase deflate zlib_deflate ctr camellia cast5 rmd160 crypto_null ccm serpent blowfish twofish_x86_64 twofish_common ecb xcbc cbc sha256_generic sha512_generic des_generic aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 aes_generic ah6 ah4 esp6 esp4 xfrm4_mode_beet xfrm4_tunnel tunnel4 xfrm4_mode_tunnel xfrm4_mode_transport xfrm6_mode_transport xfrm6_mode_ro xfrm6_mode_beet xfrm6_mode_tunnel ipcomp ipcomp6 xfrm_ipcomp xfrm6_tunnel tunnel6 af_key nfsd exportfs nfs fscache auth_rpcgss nfs_acl lockd sunrpc pcc_cpufreq bonding 8021q garp stp llc ipv6 ext3 jbd iTCO_wdt iTCO_vendor_support microcode serio_raw lpc_ich mfd_core hpilo hpwdt i7core_edac edac_core sg power_meter nx_nic(U) be2net(U) shpchp ext4 jbd2 mbcache dm_round_robin sr_mod cdrom sd_mod lpfc scsi_transport_fc scsi_tgt crc_t10dif pata_acpi ata_generic ata_piix hpsa radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core dm_multipath dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 10969, comm: foobar Not tainted 2.6.32-431.el6.x86_64 #1 HP ProLiant DL580 G7
RIP: 0010:[<ffffffff811d962d>]  [<ffffffff811d962d>] locks_remove_flock+0xfd/0x120
RSP: 0018:ffff88102b4f9de8  EFLAGS: 00010246
RAX: 0000000000000081 RBX: ffff88062902c900 RCX: 000000000000b0ba
RDX: ffff88085f312080 RSI: ffff88081ad709c0 RDI: 0000000000000282
RBP: ffff88102b4f9eb8 R08: ffff88013ee364c0 R09: 0000000000000002
R10: 0000000000000007 R11: 00000000000000dc R12: ffff880168500358
R13: ffff88102b4f9de8 R14: ffff8800b36a5080 R15: ffff88082a2fdd80
FS:  00002aaaf2ee5700(0000) GS:ffff880045880000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002aaaab0405a0 CR3: 000000085f39a000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process db2fmp (pid: 10969, threadinfo ffff88102b4f8000, task ffff88085f312080)
Stack:
 0000000000000000 0000000000000000 0000000000000000 0000000000000000
<d> 0000000000000000 ffff88062902c900 0000ab0c00000202 0000000000000000
<d> 0000000000000000 0000000000000000 0000000000000000 ffff88062902c900
Call Trace:
 [<ffffffff8118a700>] __fput+0xd0/0x210
 [<ffffffff8118a865>] fput+0x25/0x30
 [<ffffffff81185b8d>] filp_close+0x5d/0x90
 [<ffffffff81185c65>] sys_close+0xa5/0x100
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code: 49 89 c4 49 8b 04 24 48 85 c0 75 ee e8 fd 0e 35 00 48 81 c4 b8 00 00 00 5b 41 5c 41 5d c9 c3 0f b6 40 30 a8 02 75 09 a8 20 75 0f <0f> 0b 90 eb fd 4c 89 e7 e8 e6 fc ff ff eb b7 be 02 00 00 00 4c
RIP  [<ffffffff811d962d>] locks_remove_flock+0xfd/0x120
 RSP <ffff88102b4f9de8>