RHEL で XFS ファイルシステムが壊れるとカーネルパニックが発生する

Issue

システムが、以下のエラーおよびスタックトレースのいずれかでクラッシュします。

BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [<ffffffffa0354aff>] xfs_bmap_longest_free_extent+0x2f/0xb0 [xfs]
...
Call Trace:
 [<ffffffffa0354d31>] xfs_bmap_btalloc_nullfb+0x81/0xf0 [xfs]
 [<ffffffffa035c58f>] xfs_bmap_btalloc+0x37f/0x780 [xfs]
 [<ffffffffa035c99e>] xfs_bmap_alloc+0xe/0x10 [xfs]
 [<ffffffffa035d3d9>] xfs_bmapi_write+0x499/0xab0 [xfs]
 [<ffffffffa036886a>] xfs_da_grow_inode_int+0xba/0x300 [xfs]
 [<ffffffffa03a2827>] ? xfs_mod_fdblocks+0x47/0x1a0 [xfs]
 [<ffffffff811dd7f5>] ? __kmalloc+0x55/0x240
 [<ffffffffa03a9877>] ? kmem_alloc+0x97/0x130 [xfs]
 [<ffffffffa0368af6>] xfs_da_grow_inode+0x46/0xa0 [xfs]
 [<ffffffffa03526d1>] xfs_attr_shortform_to_leaf+0xb1/0x2e0 [xfs]
 [<ffffffff811de93a>] ? kmem_cache_alloc+0x1ba/0x1e0
 [<ffffffffa03a9b27>] ? kmem_zone_alloc+0x97/0x130 [xfs]
 [<ffffffffa034e601>] xfs_attr_set+0x361/0x420 [xfs]
 [<ffffffffa03c38bc>] xfs_set_acl+0xfc/0x230 [xfs]
 [<ffffffffa03c4170>] xfs_inherit_acl+0xc0/0xf0 [xfs]
 [<ffffffffa0399635>] xfs_vn_mknod+0xf5/0x250 [xfs]
 [<ffffffffa03997c3>] xfs_vn_create+0x13/0x20 [xfs]
 [<ffffffff8120b37d>] vfs_create+0xcd/0x130
 [<ffffffff8120dd4f>] do_last+0xbef/0x12a0
 [<ffffffff811deb36>] ? kmem_cache_alloc_trace+0x1d6/0x200
 [<ffffffff8120e4c2>] path_openat+0xc2/0x490
 [<ffffffff8121063b>] do_filp_open+0x4b/0xb0
 [<ffffffff8111f60f>] ? __audit_getname+0x9f/0xb0
 [<ffffffff8121d2b7>] ? __alloc_fd+0xa7/0x130
 [<ffffffff811fdb43>] do_sys_open+0xf3/0x1f0
 [<ffffffff81692e35>] ? do_page_fault+0x35/0x90
 [<ffffffff811fdc5e>] SyS_open+0x1e/0x20
 [<ffffffff81697649>] system_call_fastpath+0x16/0x1b

BUG: unable to handle kernel NULL pointer dereference at 0000000000000060
IP: [<ffffffff811f0327>] sync_inodes_sb+0x127/0x1e0
...
Call Trace:
 [<ffffffff811f6a7b>] sync_filesystem+0x5b/0xa0
 [<ffffffff811c90af>] freeze_super+0x8f/0x130
 [<ffffffff811d9a3e>] do_vfs_ioctl+0x2ae/0x4c0
 [<ffffffff8126ef4e>] ? file_has_perm+0xae/0xc0
 [<ffffffff811d9cf1>] SyS_ioctl+0xa1/0xc0
 [<ffffffff81613da9>] system_call_fastpath+0x16/0x1b

general protection fault: 0000 [#1] SMP 
Modules linked in: ip6table_filter ip6_tables iptable_ ...
RIP: 0010:[<ffffffffbb55a5e8>]  [<ffffffffbb55a5e8>] __x86_indirect_thunk_r8+0x18/0x20
...     
Call Trace:
 [<ffffffffb8c18635>] ? vfs_open+0x85/0xb0
 [<ffffffffb8c26a68>] ? may_open+0x68/0x120
 [<ffffffffb8c2aabd>] do_last+0x1ed/0x12c0
 [<ffffffffb8c2bc67>] path_openat+0xd7/0x640
 [<ffffffffb8c2d6d2>] ? user_path_at_empty+0x72/0xc0
 [<ffffffffb8c2d7fd>] do_filp_open+0x4d/0xb0
 [<ffffffffb8c3ac77>] ? __alloc_fd+0x47/0x170
 [<ffffffffb8c19b07>] do_sys_open+0x137/0x240
 [<ffffffffb911f6d5>] ? system_call_after_swapgs+0xa2/0x146
 [<ffffffffb8c19c2e>] SyS_open+0x1e/0x20
 [<ffffffffb911f795>] system_call_fastpath+0x1c/0x21
 [<ffffffffb911f6e1>] ? system_call_after_swapgs+0xae/0x146

クラッシュが発生する前に、以下の警告が表示されます。

WARNING: at lib/list_debug.c:36 __list_add+0x8a/0xc0()
list_add double add: new=ffff8805d2a9a080, prev=ffff88203c90e8a0, next=ffff8805d2a9a080.
...
Call Trace:
 [<ffffffff81603f36>] dump_stack+0x19/0x1b
 [<ffffffff8106e28b>] warn_slowpath_common+0x6b/0xb0
 [<ffffffff8106e32c>] warn_slowpath_fmt+0x5c/0x80
 [<ffffffff812ed43a>] __list_add+0x8a/0xc0
 [<ffffffff811e0837>] inode_sb_list_add+0x37/0x50
 [<ffffffffa01b9c36>] xfs_setup_inode+0x36/0x320 [xfs]
 [<ffffffffa01f6ac7>] xfs_ialloc+0x417/0x6a0 [xfs]
 [<ffffffffa01f6dca>] xfs_dir_ialloc+0x7a/0x280 [xfs]
 [<ffffffff81608632>] ? down_write+0x12/0x30
 [<ffffffffa01f74ca>] xfs_create+0x48a/0x680 [xfs]
 [<ffffffff8126b529>] ? avc_has_perm_flags+0xd9/0x1a0
 [<ffffffffa01b8a7b>] xfs_vn_mknod+0xbb/0x1e0 [xfs]
 [<ffffffffa01b8bd3>] xfs_vn_create+0x13/0x20 [xfs]
 [<ffffffff811d28ad>] vfs_create+0xcd/0x130
 [<ffffffff811d5e7f>] do_last+0xb8f/0x1270
 [<ffffffff811ab87e>] ? kmem_cache_alloc_trace+0x1ce/0x1f0
 [<ffffffff811d6622>] path_openat+0xc2/0x4c0
 [<ffffffff811d6c49>] ? putname+0x29/0x40
 [<ffffffff811d7a5b>] do_filp_open+0x4b/0xb0
 [<ffffffff811e44a7>] ? __alloc_fd+0xa7/0x130
 [<ffffffff811c58b3>] do_sys_open+0xf3/0x1f0
 [<ffffffff811c59ce>] SyS_open+0x1e/0x20
 [<ffffffff81613da9>] system_call_fastpath+0x16/0x1b