kernel BUG at fs/nfsd/nfs4recover.c:361!

Issue

• An NFS server system crashes in nfsd4_init_recdir with the following messages.

------------[ cut here ]------------
kernel BUG at fs/nfsd/nfs4recover.c:361!
invalid opcode: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/online
CPU 8 
Modules linked in: nfsd lockd nfs_acl auth_rpcgss vxodm(P)(U) vxfen(P)(U) gab(P)(U) snapapi26(P)(U) llt(P)(U) rdma_cm
 ib_cm iw_cm ib_sa ib_mad ib_core ib_addr netconsole configfs autofs4 sunrpc dmpaa(P)(U) vxspec(P)(U) vxio(P)(U) vxdm
p(P)(U) cpufreq_ondemand acpi_cpufreq freq_table mperf bonding 8021q garp stp llc ipv6 vxcafs(P)(U) vxportal(P)(U) fd
d(P)(U) vxfs(P)(U) exportfs vfat fat uinput microcode iTCO_wdt iTCO_vendor_support sb_edac edac_core i2c_i801 i2c_cor
e lpc_ich mfd_core power_meter acpi_ipmi ipmi_si ipmi_msghandler sg tg3 ptp pps_core ext3 jbd mbcache sddlmfdrv(P)(U)
 sddlmadrv(P)(U) sr_mod cdrom sd_mod ahci xhci_hcd lpfc scsi_transport_fc scsi_tgt crc_t10dif wmi dm_mirror dm_region
_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 15229, comm: rpc.nfsd Tainted: P           ---------------    2.6.32-504.el6.x86_64 #1 NEC Express5800/R120f-2M 
[N8100-2218Y]/MS-S0901
RIP: 0010:[<ffffffffa0dbceb7>]  [<ffffffffa0dbceb7>] nfsd4_init_recdir+0x67/0xa0 [nfsd]
RSP: 0018:ffff8810479d7dd8  EFLAGS: 00010286
RAX: 000000000000004d RBX: ffffffffa0dc5cc0 RCX: 0000000000007a08
RDX: 0000000000000000 RSI: 0000000000000046 RDI: 0000000000000246
RBP: ffff8810479d7df8 R08: 0000000000740004 R09: 0000000000000004
R10: ffff88106f381bc0 R11: 0000000000001000 R12: 0000000000000000
R13: 0000000000000801 R14: 0000000000000000 R15: 00007f9b260c2010
FS:  00007f9b24d17700(0000) GS:ffff88089c440000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f9b260cc2d8 CR3: 000000106160f000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process rpc.nfsd (pid: 15229, threadinfo ffff8810479d6000, task ffff881061290040)
Stack:
 0000000000000008 0000000000000000 ffff8810479d7df8 0000000000000008
<d> ffff8810479d7e18 ffffffffa0db3aff 0000000000000000 0000000000000008
<d> ffff8810479d7e48 ffffffffa0d959f5 ffff88106f585008 ffff8810479d7e68
Call Trace:
 [<ffffffffa0db3aff>] nfs4_state_start+0x1f/0x110 [nfsd]
 [<ffffffffa0d959f5>] nfsd_svc+0x145/0x1e0 [nfsd]
 [<ffffffffa0d96bf0>] ? write_threads+0x0/0xe0 [nfsd]
 [<ffffffffa0d96cba>] write_threads+0xca/0xe0 [nfsd]
 [<ffffffff811318de>] ? __get_free_pages+0xe/0x50
 [<ffffffff81131936>] ? get_zeroed_page+0x16/0x20
 [<ffffffff811b7106>] ? simple_transaction_get+0xc6/0xe0
 [<ffffffffa0d968e6>] nfsctl_transaction_write+0x76/0x90 [nfsd]
 [<ffffffff8118e058>] vfs_write+0xb8/0x1a0
 [<ffffffff8118ea21>] sys_write+0x51/0x90
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code: 00 00 01 00 48 89 df e8 58 48 3e e0 48 3d 00 f0 ff ff 48 89 05 ab c1 01 00 77 14 48 8b 7d e8 e8 b0 95 2e e0 48 83 c4 18 5b c9 c3 <0f> 0b eb fe 48 89 de 48 c7 c7 38 08 dc a0 31 c0 e8 b8 c4 76 e0 
RIP  [<ffffffffa0dbceb7>] nfsd4_init_recdir+0x67/0xa0 [nfsd]
 RSP <ffff8810479d7dd8>