kernel null pointer reference after add trunc_xino option for mount

[jemicheng .]

   Hi,
   After I turn on the turnc_xino option, the system crashes randomly when
   write/delete the same file under some aufs mounted folder. The kernel back
   trace is as the following.
   [52226.790000]  [<c00983a8>]  (__alloc_pages_nodemask+0x0/0x728)  from
   [<c00a33a4>] (shmem_getpage+0x1f8/0xcdc)
   [52226.790000] [<c00a31ac>] (shmem_getpage+0x0/0xcdc) from [<c00a7054>]
   (shmem_file_aio_read+0x1e8/0x3e8)
   [52226.790000]   [<c00a6e6c>]   (shmem_file_aio_read+0x0/0x3e8)   from
   [<c00caba4>] (do_sync_read+0xc0/0x104)
   [52226.790000] [<c00caae4>] (do_sync_read+0x0/0x104) from [<c00cb80c>]
   (vfs_read+0xb4/0x148)
   [52226.790000]  [<c00cb758>]  (vfs_read+0x0/0x148)  from  [<bf009eb8>]
   (vfsub_read_u+0x14/0x30 [aufs])
   [52226.790000]Â  r8:c44bf6e0 r7:c44bf6c0 r6:c3817000 r5:00000000 r4:c6185120
   [52226.790000] [<bf009ea4>] (vfsub_read_u+0x0/0x30 [aufs]) from [<bf009f14>]
   (vfsub_read_k+0x40/0x7c [aufs])
   [52226.790000]Â  r5:00000000 r4:00000000
   [52226.790000] [<bf009ed4>] (vfsub_read_k+0x0/0x7c [aufs]) from [<bf00b320>]
   (au_copy_file+0xec/0x394 [aufs])
   [52226.790000]Â  r5:00001000 r4:00000000
   [52226.790000]   [<bf00b234>]   (au_copy_file+0x0/0x394  [aufs])  from
   [<bf005654>] (au_xino_create2+0xe4/0x26c [aufs])
   [52226.790000]  [<bf005570>]  (au_xino_create2+0x0/0x26c  [aufs]) from
   [<bf005840>] (au_xino_trunc+0x64/0x22c [aufs])
   [52226.790000]   [<bf0057dc>]  (au_xino_trunc+0x0/0x22c  [aufs])  from
   [<bf005a9c>] (xino_do_trunc+0x94/0x1e4 [aufs])
   [52226.790000]   [<bf005a08>]  (xino_do_trunc+0x0/0x1e4  [aufs])  from
   [<bf0095b4>] (wkq_func+0x1c/0x54 [aufs])
   [52226.790000] [<bf009598>] (wkq_func+0x0/0x54 [aufs]) from [<c005fa28>]
   (process_one_work+0x148/0x400)
   [52226.790000]Â  r4:c7938460 r3:00000001
   [52226.790000] [<c005f8e0>] (process_one_work+0x0/0x400) from [<c0062878>]
   (worker_thread+0x16c/0x4b0)
   [52226.790000] [<c006270c>] (worker_thread+0x0/0x4b0) from [<c0066bf0>]
   (kthread+0x90/0x98)
   [52226.790000]   [<c0066b60>]   (kthread+0x0/0x98)  from  [<c004dd44>]
   (do_exit+0x0/0x718)
   [52226.790000]Â  r7:00000013 r6:c004dd44 r5:c0066b60 r4:c79cded4
   [52226.790000] Code: e50be06c e58dc000 e59f0574 e59431dc (e5922050)
   (1) kernel version
   2.6.38.8
   (2) /proc/mount
   rootfs / rootfs rw 0 0
   /dev/root / squashfs ro,relatime 0 0
   tmpfs /tmp tmpfs rw,relatime 0 0
   none / aufs rw,sync,relatime,si=bd7b310d,trunc_xino 0 0
   proc /proc proc rw,relatime 0 0
   tmpfs /tmp tmpfs rw,relatime 0 0
   devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
   sysfs /sys sysfs rw,relatime 0 0
   debugfs /debug debugfs rw,relatime 0 0
   ubi0:ubifs1 /mnt/nand ubifs rw,relatime 0 0
   (3)aufs version
   aufs 2.2-standalone.tree-38-20111024
   (4)/sys/module/aufs/
   # cd /sys/module/aufs/
   # ls
   holders     notes       refcnt      srcversion
   initstate   parameters  sections    version
   # cat initstate
   live
   # cat refcnt
   36
   # cat srcversion
   06E509D7A48AD8F609ECB75
   # cat version
   2.2-standalone.tree-38-20111024
   # ls parameters/
   brs
   # cat parameters/brs
   1
   # ls notes/
   # ls sections/
   __ex_table  __param
   # cat sections/__ex_table
   0xbf0232b0
   # cat sections/__param
   0xbf0212cc
   # ls holders/
   (5)/sys/fs/aufs/
   # cd /sys/fs/aufs/
   # ls
   config       si_b802a4cd
   # cat config
   CONFIG_AUFS_FS=m
   CONFIG_AUFS_BRANCH_MAX_127=y
   CONFIG_AUFS_SBILIST=y
   CONFIG_AUFS_BR_RAMFS=y
   CONFIG_AUFS_BDEV_LOOP=y
   # ls si_b802a4cd/
   br0Â Â Â Â Â  br1Â Â Â Â Â  xi_path
   # cat si_b802a4cd/br0
   /tmp/rw=rw
   # cat si_b802a4cd/br1
   /=rr
   # cat si_b802a4cd/xi_path
   /tmp/rw/.aufs.xino

------------------------------------------------------------------------------