RHEL6: kernel panic - NFS rpciod crashes in get_page called from tcp_sendpage

Issue

• Kernel / machine crashes with the following message

general protection fault: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:06.0/local_cpus
CPU 0
Modules linked in: autofs4 nfs lockd fscache nfs_acl auth_rpcgss sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 sg microcode i2c_piix4 i2c_core virtio_console virtio_net ext4 mbcache jbd2 virtio_blk sr_mod cdrom virtio_pci virtio_ring virtio pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid: 1651, comm: rpciod/0 Not tainted 2.6.32-279.11.1.el6.x86_64 #1 Red Hat RHEV Hypervisor
RIP: 0010:[<ffffffff8112b181>]  [<ffffffff8112b181>] get_page+0x31/0xb0
RSP: 0018:ffff88060de73be0  EFLAGS: 00010216
RAX: ffffffff81b14fe0 RBX: ffffea001380e876 RCX: 0000000000001000
RDX: 8805d9cf8b40ffff RSI: 0000000000010430 RDI: ffffea001380e876
RBP: ffff88060de73bf0 R08: 0000000000000003 R09: 0000000000000000
R10: ffffea001380e876 R11: 0000000000000003 R12: ffff88060c051480
R13: ffff8805d2f88dc0 R14: 0000000000000000 R15: 0000000000001000
FS:  0000000000000000(0000) GS:ffff880028200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00007fd95c3cd00f CR3: 00000000149d8000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Process rpciod/0 (pid: 1651, threadinfo ffff88060de72000, task ffff88060a560ae0)
Stack:
 ffff88060c051480 0000000000000000 ffff88060de73ca0 ffffffff8147f8e5
<d> 0000000156447608 0000000000000000 ffff880600000003 0000000000000003
<d> 0000000000001000 ffffea001380e876 0000000000000000 0000404000000000
Call Trace:
 [<ffffffff8147f8e5>] tcp_sendpage+0x485/0x580
 [<ffffffffa0249725>] xs_sendpages+0xf5/0x220 [sunrpc]
 [<ffffffffa0244130>] ? call_transmit+0x0/0x2c0 [sunrpc]
 [<ffffffffa024998d>] xs_tcp_send_request+0x5d/0x160 [sunrpc]
 [<ffffffffa0244130>] ? call_transmit+0x0/0x2c0 [sunrpc]
 [<ffffffffa02471f3>] xprt_transmit+0x83/0x2e0 [sunrpc]
 [<ffffffffa0244130>] ? call_transmit+0x0/0x2c0 [sunrpc]
 [<ffffffffa0244308>] call_transmit+0x1d8/0x2c0 [sunrpc]
 [<ffffffffa024ee37>] __rpc_execute+0x77/0x350 [sunrpc]
 [<ffffffffa024f1b0>] ? rpc_async_schedule+0x0/0x20 [sunrpc]
 [<ffffffffa024f1c5>] rpc_async_schedule+0x15/0x20 [sunrpc]
 [<ffffffff8108c7f0>] worker_thread+0x170/0x2a0
 [<ffffffff81092160>] ? autoremove_wake_function+0x0/0x40
 [<ffffffff8108c680>] ? worker_thread+0x0/0x2a0
 [<ffffffff81091df6>] kthread+0x96/0xa0
 [<ffffffff8100c14a>] child_rip+0xa/0x20
 [<ffffffff81091d60>] ? kthread+0x0/0xa0
 [<ffffffff8100c140>] ? child_rip+0x0/0x20
Code: 83 ec 08 0f 1f 44 00 00 66 83 3f 00 48 89 fb 78 0b f0 ff 43 08 48 83 c4 08 5b c9 c3 48 8b 57 10 66 83 3f 00 79 eb 48 39 d7 74 e6 <8b> 4a 08 48 8d 72 08 85 c9 74 db 8d 79 01 48 63 c1 48 63 ff f0
RIP  [<ffffffff8112b181>] get_page+0x31/0xb0
 RSP <ffff88060de73be0>