Bug reported from Ron Minnich

I'm trying to get
9 mount etc. etc.
working. i want to build a linux desktop that is a 'work alike' for a
plan 9 desktop. So I need to mount /wsys, /9dev, etc.

Either the commented or uncommented code below gets an oops:

BUG: unable to handle kernel paging request at 68760118
IP: [<f8c133dc>] :9pnet:p9_client_destroy+0x35/0x80
*pde = 00000000
Oops: 0000 [#5] SMP
Modules linked in: 9p 9pnet i915 drm cpufreq_ondemand acpi_cpufreq sbs
sbshc snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event
snd_seq snd_seq_device snd_pcm_oss sdhci snd_mixer_oss mmc_core
snd_pcm pcspkr i2c_i801 e1000e snd_timer iwl3945 video snd output
battery ac soundcore snd_page_alloc button sg joydev ahci libata dock
sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd [last unloaded:
microcode]

Pid: 5690, comm: mount Tainted: G      D  (2.6.25 #2)
EIP: 0060:[<f8c133dc>] EFLAGS: 00010202 CPU: 0
EIP is at p9_client_destroy+0x35/0x80 [9pnet]
EAX: 68760108 EBX: f2efa640 ECX: 00000000 EDX: 68760108
ESI: f2efa640 EDI: 00000000 EBP: ffffffa3 ESP: f1916e0c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process mount (pid: 5690, ti=f1916000 task=f2f626a0 task.ti=f1916000)
Stack: ffffffa3 f2efa640 f8c13781 f6ca7a20 f190f000 f8c20a1c f6ca7738 f2efae80
      c01cc9a0 f1916e58 f6ca7738 f8c24850 00000000 00000000 f2efae80 0000000a
      f2efae80 f190f000 f8c20b72 00000003 00271d65 f2f64001 f755bf4c f1916f34
Call Trace:
 [<f8c13781>] p9_client_create+0x29c/0x2a6 [9pnet]
 [<f8c20a1c>] v9fs_session_init+0xc7/0x2ff [9p]
 [<c01cc9a0>] match_token+0x62/0x18a
 [<f8c20b72>] v9fs_session_init+0x21d/0x2ff [9p]
 [<f8c1f140>] v9fs_get_sb+0x80/0x1f0 [9p]
 [<c01808ab>] alloc_vfsmnt+0x86/0xac
 [<c0170427>] vfs_kern_mount+0x39/0x72
 [<c017049e>] do_kern_mount+0x2f/0xb4
 [<c018176a>] do_new_mount+0x55/0x89
 [<c018190b>] do_mount+0x16d/0x18c
 [<c017fedd>] copy_mount_options+0x26/0x109
 [<c0181997>] sys_mount+0x6d/0xa6
 [<c01058fe>] syscall_call+0x7/0xb
 =======================
Code: c3 74 1f 53 64 a1 00 90 42 c0 ff b0 dc 01 00 00 68 82 61 c1 f8
68 b0 63 c1 f8 e8 9a 30 51 c7 83 c4 10 8b 53 1c 85 d2 74 14 89 d0 <ff>
52 10 8b 43 1c e8 0f 7e 55 c7 c7 43 1c 00 00 00 00 8b 4b 28
EIP: [<f8c133dc>] p9_client_destroy+0x35/0x80 [9pnet] SS:ESP 0068:f1916e0c
---[ end trace 6d9db7b540d27f19 ]---

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/socket.h>
#include <sys/un.h>


int
main(int argc, char *argv[])
{
       int fd;
       int fd2;
       int ret;
       char command[512];
       struct sockaddr_un un = {AF_UNIX};
       if (argc < 3)
               errx(1, "arg count");

       fd = socket(PF_UNIX, SOCK_STREAM, 0);
       strncpy(un.sun_path, argv[1], sizeof(un.sun_path));
       fd2 = connect(fd, (const struct sockaddr *)&un, sizeof(un));
/*
       sprintf(command, "rfdno=%d,wfdno=%d", fd2, fd2);
       ret = mount("none", argv[2], "9p", 0, command);
       if (ret)
               errx(ret, "no mount");
       return ret;
 */
       sprintf(command, "mount -t 9p none %s -o rfdno=%d,wfdno=%d",
argv[2], fd2, fd2
);
       system(command);
       return 0;
}