The Coverity checker spotted that commit 4584f520e1f773082ef44ff4f8969a5d992b16ec introduced the following NULL dereference in 2.6.24-rc6:

<--  snip  -->

...
static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
                           const char *dev_name, void *raw_data,
                           struct vfsmount *mnt)
{
...
        if (s->s_fs_info != server) {
                nfs_free_server(server);
                server = NULL;     <---------------
        }

        if (!s->s_root) {
                /* initial superblock/root creation */
                nfs_clone_super(s, data->sb);
        }

        mntroot = nfs_get_root(s, data->fh);
        if (IS_ERR(mntroot)) {
                error = PTR_ERR(mntroot);
                goto error_splat_super;
        }
        if (mntroot->d_inode->i_op != server->nfs_client->rpc_ops->dir_inode_ops) {
...

<--  snip  -->