On Tue, 23 Nov 2021, J. Bruce Fields wrote: > > > > Hm, playing with reproducer; it takes more than one mount. My simplest > > reproducer is: > > > > mount -overs=3 server:/path /mnt/ > > umount /mnt/ > > mount -overs=4.0 server:/path /mnt/ > > > > ... and the client crashes here. > > Also: the problem starts with the last patch ("lockd: use > svc_set_num_threads() for thread start and stop"). That helps. It points to lockd, and so to lockd stopping. Lockd wasn't stopping for me because I had nfsd running. I disabled nfsd and tried again - and got the crash. The problem is #define svc_serv_is_pooled(serv) ((serv)->sv_ops->svo_function) Why does the presence of a svo_function mark the serv as being 'pooled'??? That last patch gave lockd an svo_function, so when threats were stopped, the pool was released. But as lockd doesn't create a pooled service, the pool was never claimed. So the pool_map->npools was set to zero even though it should have still been active. I'll probably change svc_serv_is_pooled() to test serv->sv_nrpools, and allow that to be zero for non-pooled services. Thanks for your testing help, NeilBrown