CVE-2011-4325: Null Pointer Dereference

diotest4 from LTP will crash client on NFS mount. Not a regression, 5.7 GA kernel has the same issue.

Unable to handle kernel NULL pointer dereference at 0000000000000038 RIP: [<ffffffff887aed65>] :nfs:putnfsopencontext+0x7/0x93 PGD 16bba2067 PUD 14bcd1067 PMD 0 Oops: 0000 [1] SMP last sysfs file: /devices/pci0000:00/0000:00:00.0/localcpus CPU 2 Modules linked in: nfs nfsd exportfs nfsacl authrpcgss autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc cpufreqondemand acpicpufreq freqtable mperf iptREJECT ip6tREJECT xttcpudp ip6tablefilter ip6tables xtables be2iscsi ibiser rdmacm ibcm iwcm ibsa ibmad ibcore ibaddr iscsitcp bnx2i cnic ipv6 xfrmnalgo cryptoapi uio cxgb3i libcxgbi cxgb3 8021q libiscsitcp libiscsi2 scsitransportiscsi2 scsitransportiscsi dmmirror dmmultipath scsidh video backlight sbs powermeter hwmon i2cec dellwmi wmi button battery asusacpi acpimemhotplug ac parportpc lp parport joydev i2ci801 i2ccore idecd cdcether i7coreedac cdrom usbnet edacmc tpmtis tpm tpmbios bnx2 sg pcspkr dmraid45 dmmessage dmregionhash dmlog dmmod dmmemcache atapiix libata shpchp megaraidsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 4577, comm: diotest4 Not tainted 2.6.18-296.el5 #1 RIP: 0010:[<ffffffff887aed65>] [<ffffffff887aed65>] :nfs:putnfsopencontext+0x7/0x93 RSP: 0018:ffff810153cc1d28 EFLAGS: 00010246 RAX: ffff81014df95b10 RBX: ffff81014df95840 RCX: ffff81017fe5e608 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff81014df95840 R08: ffff81014df95840 R09: 0000000000000000 R10: ffff81014df95840 R11: 0000000000000310 R12: 0000000000000000 R13: 0000000000001000 R14: ffff81014aff9218 R15: ffff81014ced68c0 FS: 00002b51e08b3af0(0000) GS:ffff810105524ec0(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000038 CR3: 000000014a8fb000 CR4: 00000000000006a0 Process diotest4 (pid: 4577, threadinfo ffff810153cc0000, task ffff81017fc877a0) Stack: ffff81014df95840 ffff81014df95840 ffff81014ced6898 ffffffff887b4459 fffffffffffffff4 ffffffff887ccca6 ffff810153cc1e68 0000000000001000 ffff810153cc1e08 ffff81014a335a00 0000000000001000 0000000000008000 Call Trace: [<ffffffff887b4459>] :nfs:nfsreaddatarelease+0x10/0x16 [<ffffffff887ccca6>] :nfs:nfsfiledirectread+0x1b8/0x52f [<ffffffff8000cf47>] dosyncread+0xc7/0x104 [<ffffffff887aef81>] :nfs:nfsopen+0x10b/0x125 [<ffffffff800a3346>] autoremovewakefunction+0x0/0x2e [<ffffffff8000b72f>] vfsread+0xcb/0x171 [<ffffffff80011d15>] sysread+0x45/0x6e [<ffffffff8005d28d>] tracesys+0xd5/0xe0

Code: 48 8b 47 38 48 89 fb 48 8b 68 10 48 8d b5 b4 00 00 00 e8 c9 RIP [<ffffffff887aed65>] :nfs:putnfsopencontext+0x7/0x93 RSP <ffff810153cc1d28> CR2: 0000000000000038 <0>Kernel panic - not syncing: Fatal exception