RHEL6: cifsd caused a panic during failover - cifs_demultiplex_thread( ) => rip dequeue_mid+0x3e

Issue

• kernel crashed with following logs:

RPC: fragment too large: 1195725856
RPC: fragment too large: 1195725856
CIFS VFS: No task to wake, unknown frame received! NumMids 5
Received Data is: : dump of 37 bytes of data at 0xffff8814ee8d1b40
 27000000 424d53ff 00000024 c0018000 . . . ' . S M B $ . . . . . . .
 00000000 00000000 00000000 6075003f . . . . . . . . . . . . ? . u `
 ffff003f 0000ff02 ? . . . .
general protection fault: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/online
CPU 12 
Modules linked in: nfs lockd fscache auth_rpcgss nfs_acl sunrpc vxodm(P)(U) vxgms(P)(U) amf(P)(U) vxglm(P)(U) vxfen(P)(U) gab(P)(U) llt(P)(U) rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr autofs4 des_generic ecb md4 nls_utf8 cifs dmpaa(P)(U) vxspec(P)(U) vxio(P)(U) vxdmp(P)(U) ipv6 vxcafs(P)(U) vxportal(P)(U) fdd(P)(U) vxfs(P)(U) vsock(U) exportfs microcode vmware_balloon shpchp sg vmci(U) i2c_piix4 ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom vmxnet3 vmw_pvscsi pata_acpi ata_generic ata_piix vmwgfx ttm drm_kms_helper drm i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid: 3745, comm: cifsd Tainted: P           -- ------------    2.6.32-754.15.3.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[<ffffffffa0f2d7de>]  [<ffffffffa0f2d7de>] dequeue_mid+0x3e/0x70 [cifs]
RSP: 0018:ffff881fd55d7e30  EFLAGS: 00010203
RAX: dead000000200200 RBX: ffff880126df0ec0 RCX: ffff8801fece3780
RDX: dead000000100100 RSI: 0000000000000000 RDI: ffffffffa0f62344
RBP: ffff881fd55d7e40 R08: 00000000f863a481 R09: 00000000ffffffff
R10: ffff881fd57d9100 R11: ffff881fd57d91b0 R12: 0000000000000000
R13: ffff8801fece3780 R14: ffff881fd5575520 R15: ffff881fd5575520
FS:  0000000000000000(0000) GS:ffff88009a100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 0000000080050033
CR2: 00007f15576c6000 CR3: 0000001f22df8000 CR4: 00000000001607e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process cifsd (pid: 3745, threadinfo ffff881fd55d4000, task ffff881fd5575520)
Stack:
 ffff88200a131000 ffff880126df0ec0 ffff881fd55d7ee0 ffffffffa0f34286
<d> ffff881fd5575ad8 ffff881fd55d7fd8 0000000000014068 ffff881fd5575ad8
<d> ffff882000003010 ffff88200a131048 ffff88200a131148 ffff88200a131178
Call Trace:
 [<ffffffffa0f34286>] cifs_demultiplex_thread+0x896/0xe30 [cifs]
 [<ffffffffa0f339f0>] ? cifs_demultiplex_thread+0x0/0xe30 [cifs]
 [<ffffffff810aac00>] kthread+0xa0/0xc0
 [<ffffffff815657e0>] child_rip+0x20/0x30
 [<ffffffff810aab60>] ? kthread+0x0/0xc0
 [<ffffffff815657c0>] ? child_rip+0x0/0x30
Code: 44 00 00 48 89 fb 41 89 f4 48 c7 c7 44 23 f6 a0 e8 28 f1 62 e0 41 80 fc 01 48 8b 13 19 c0 83 e0 f4 83 c0 10 89 43 48 48 8b 43 08 <48> 89 42 08 48 89 10 48 c7 c0 44 23 f6 a0 48 89 1b 48 89 5b 08 
RIP  [<ffffffffa0f2d7de>] dequeue_mid+0x3e/0x70 [cifs]
 RSP <ffff881fd55d7e30>