RHEL6.3: System rebooted with "BUG: unable to handle kernel NULL pointer dereference at 0000000000000117 IP: [<ffffffff8119388c>] __d_lookup+0x8c/0x150"

Issue

• Our server rebooted with no information available as to what caused the reboot. Vmcore analysis shows the following in the kernel ring buffer;

crash> log | tail -50
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
BUG: unable to handle kernel NULL pointer dereference at 0000000000000117
IP: [<ffffffff8119388c>] __d_lookup+0x8c/0x150
PGD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/cpu11/cpufreq/scaling_setspeed
CPU 21 
Modules linked in: bluetooth rfkill bridge nfs lockd fscache nfs_acl auth_rpcgss autofs4 sunrpc pcc_cpufreq bonding 8021q garp stp llc ipv6 power_meter microcode serio_raw sg iTCO_wdt iTCO_vendor_support hpilo hpwdt bnx2 i7core_edac edac_core shpchp ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix hpsa radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 15118, comm: smbd Not tainted 2.6.32-279.5.2.el6.x86_64 #1 HP ProLiant DL380 G7
RIP: 0010:[<ffffffff8119388c>]  [<ffffffff8119388c>] __d_lookup+0x8c/0x150
RSP: 0018:ffff8804b47e9af8  EFLAGS: 00010206
RAX: 0000000000000013 RBX: 00000000000000ff RCX: 0000000000000017
RDX: 018721e08b802f2d RSI: ffff8804b47e9c48 RDI: ffff88031b6d6a40
RBP: ffff8804b47e9b48 R08: 00000000ffffffff R09: 0000000000000fff
R10: 0000000000000013 R11: 0000000000000000 R12: 00000000000000e7
R13: ffff88031b6d6a40 R14: 0000000097ede984 R15: ffff880319cadb78
FS:  00007f2c526ec7c0(0000) GS:ffff8804b0140000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000117 CR3: 00000006fea84000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process smbd (pid: 15118, threadinfo ffff8804b47e8000, task ffff880010f7eae0)
Stack:
 ffff88073c65e37c 00000013a03ed822 0000000000000013 ffff8804b47e9c48
<d> 00000000006c2aa2 00000000000dc4d4 ffff8804b47e9c48 ffff88031b6d6a40
<d> ffff8805e0c33000 ffff880319cadb78 ffff8804b47e9b78 ffffffff811941ec
Call Trace:
 [<ffffffff811941ec>] d_lookup+0x3c/0x60
 [<ffffffffa03d3547>] nfs_readdir_page_filler+0x257/0x580 [nfs]
 [<ffffffffa03d3a78>] nfs_readdir_xdr_to_array+0x208/0x2b0 [nfs]
 [<ffffffffa03d3b46>] nfs_readdir_filler+0x26/0xa0 [nfs]
 [<ffffffff8111630b>] do_read_cache_page+0x7b/0x180
 [<ffffffffa03d3b20>] ? nfs_readdir_filler+0x0/0xa0 [nfs]
 [<ffffffff8118f1f0>] ? filldir+0x0/0xe0
 [<ffffffff81116459>] read_cache_page_async+0x19/0x20
 [<ffffffff8111646e>] read_cache_page+0xe/0x20
 [<ffffffffa03d3d12>] nfs_readdir+0x152/0x5d0 [nfs]
 [<ffffffffa03ed510>] ? nfs3_decode_dirent+0x0/0x3d0 [nfs]
 [<ffffffff8118f1f0>] ? filldir+0x0/0xe0
 [<ffffffff8118f470>] vfs_readdir+0xc0/0xe0
 [<ffffffff8118f5f9>] sys_getdents+0x89/0xf0
 [<ffffffff8100b0f2>] system_call_fastpath+0x16/0x1b
Code: 48 03 05 e8 1c a7 00 48 8b 18 8b 45 bc 48 85 db 48 89 45 c0 75 11 eb 74 0f 1f 80 00 00 00 00 48 8b 1b 48 85 db 74 65 4c 8d 63 e8 <45> 39 74 24 30 75 ed 4d 39 6c 24 28 75 e6 4d 8d 7c 24 08 4c 89 
RIP  [<ffffffff8119388c>] __d_lookup+0x8c/0x150
 RSP <ffff8804b47e9af8>
CR2: 0000000000000117