Paniced in an extension of snumbd26 processing.

Issue

• Our customer encountered a kernel panic issue, checking vmcore, it occurred in an extension of snumbd26 processing.

crash>log
::
numbdctl_release: OK s=ffff884022178800
snumbdctl_open: OK s=ffff888024e58e00
session_init: OK. kdev=f9:1, len=629137467 s=ffff888024e58e00.
snumbdctl_release: OK s=ffff888024e58e00
snumbdctl_open: OK s=ffff88402301ac00
heartbeat_timer_func: Deadlock detected. Finishing(768,4)...
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff888024e58e30
IP: [<ffff888024e58e30>] 0xffff888024e58e30
PGD 11067 PUD 80000080000001e3
Oops: 0011 [#1] SMP
last sysfs file: /sys/devices/system/cpu/online
CPU 31
Modules linked in: snapapi26(P)(U) snumbd26(P)(U) nfs fscache fuse clpkhb(U) cpufreq_powersave nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs ipmi_devintf acpi_cpufreq freq_table mperf bonding 8021q garp stp llc ipv6 iptable_filter ip_tables vfat fat sddlmfdrv(P)(U) sddlmadrv(P)(U) uinput microcode iTCO_wdt iTCO_vendor_support osst st power_meter i2c_i801 i2c_core lpc_ich mfd_core tg3 ptp pps_core bnx2x libcrc32c mdio sg ext4 jbd2 mbcache sr_mod cdrom sd_mod mpt2sas scsi_transport_sas raid_class pata_acpi ata_generic ata_piix lpfc scsi_transport_fc scsi_tgt crc_t10dif megaraid_sas wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 0, comm: swapper Tainted: P           ---------------    2.6.32-431.20.3.el6.x86_64 #1 NEC Express5800/R140e-4 [N8100-7004Y]/BM-ML
RIP: 0010:[<ffff888024e58e30>]  [<ffff888024e58e30>] 0xffff888024e58e30
RSP: 0018:ffff8841616c3d98  EFLAGS: 00010092
RAX: ffff8853006a38e8 RBX: ffff888024e58e08 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff8853006a38e8
RBP: ffff8841616c3de0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000006a3930
R13: ffff888024e58e50 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8841616c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: ffff888024e58e30 CR3: 000000130662f000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff884026da2000, task ffff888027facae0)
Stack:
 ffffffff810546b9 ffff888024e58ea8 0000000300000000 ffff888024e58e00
<d> ffff888024e58e48 0000000000000286 0000000000000003 0000000000000000
<d> 0000000000000000 ffff8841616c3e20 ffffffff81058bc8 ffff8841616c3e00
Call Trace:
 <IRQ>
 [<ffffffff810546b9>] ? __wake_up_common+0x59/0x90
 [<ffffffff81058bc8>] __wake_up+0x48/0x70
 [<ffffffffa044ed60>] ? heartbeat_timer_func+0x0/0x190 [snumbd26]
 [<ffffffffa044ee32>] heartbeat_timer_func+0xd2/0x190 [snumbd26]
 [<ffffffff810847f7>] run_timer_softirq+0x197/0x340
 [<ffffffff810ac575>] ? tick_dev_program_event+0x65/0xc0
 [<ffffffff8107a5f1>] __do_softirq+0xc1/0x1e0
 [<ffffffff810ac64a>] ? tick_program_event+0x2a/0x30
 [<ffffffff8100c30c>] call_softirq+0x1c/0x30
 [<ffffffff8100fa75>] do_softirq+0x65/0xa0
 [<ffffffff8107a4a5>] irq_exit+0x85/0x90
 [<ffffffff81531fca>] smp_apic_timer_interrupt+0x4a/0x60
 [<ffffffff8100bb93>] apic_timer_interrupt+0x13/0x20
 <EOI>
 [<ffffffff812e134e>] ? intel_idle+0xde/0x170
 [<ffffffff812e1331>] ? intel_idle+0xc1/0x170
 [<ffffffff814272f7>] cpuidle_idle_call+0xa7/0x140
 [<ffffffff81009fc6>] cpu_idle+0xb6/0x110
 [<ffffffff81521c5c>] start_secondary+0x2ac/0x2ef
Code: 00 ff ff 00 8e e5 24 80 88 ff ff 00 00 00 00 00 00 00 00 3b e0 7f 25 00 00 00 00 00 03 00 00 04 00 00 00 00 00 00 00 f0 56 00 00 <25> 02 25 02 00 00 00 00 38 8e e5 24 80 88 ff ff 01 00 00 00 00
RIP  [<ffff888024e58e30>] 0xffff888024e58e30
 RSP <ffff8841616c3d98>
CR2: ffff888024e58e30
crash>