Why did kernel panic at mod_timer function?

Issue

• kernel crashes with RIP mod_timer called from bridge module br_multicast_add_group
• crashes did not occur in kernel 2.6.32-358.23.2.el6.
• Kernel panicked with following traces :

 #4 [ffff884894a03760] __bad_area_nosemaphore at ffffffff8104a295
 #5 [ffff884894a037b0] bad_area_nosemaphore at ffffffff8104a363
 #6 [ffff884894a037c0] __do_page_fault at ffffffff8104aabf
 #7 [ffff884894a038e0] do_page_fault at ffffffff8152d45e
 #8 [ffff884894a03910] page_fault at ffffffff8152a815
    [exception RIP: mod_timer+33]
    RIP: ffffffff81086151  RSP: ffff884894a039c0  RFLAGS: 00010286
    RAX: 0000000000000057  RBX: ffff884894a03b10  RCX: ffffffffffffffea
    RDX: ffffffffffffffea  RSI: 000000016334e0f8  RDI: 000000000000002a
    RBP: ffff884894a03a00   R8: 000000000001be44   R9: 00000000000000d0
    R10: 00000000ffffffea  R11: ffff884894a03860  R12: ffff88481bfcc400
    R13: ffff885e7d72ba40  R14: ffff886018f0c6e0  R15: ffff886018f0d118
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #9 [ffff884894a03a08] br_multicast_add_group at ffffffffa0295cd0 [bridge]
#10 [ffff884894a03a58] br_multicast_rcv at ffffffffa02975c1 [bridge]
#11 [ffff884894a03bc8] br_handle_frame_finish at ffffffffa028d9ac [bridge]
#12 [ffff884894a03c18] br_handle_frame at ffffffffa028dd3a [bridge]
#13 [ffff884894a03c58] __netif_receive_skb at ffffffff8145b5c9
#14 [ffff884894a03cb8] netif_receive_skb at ffffffff8145f1b8
#15 [ffff884894a03cf8] napi_skb_finish at ffffffff8145f2c0
#16 [ffff884894a03d18] napi_gro_receive at ffffffff81460a29
#17 [ffff884894a03d38] tg3_poll_work at ffffffffa0165b54 [tg3]
#18 [ffff884894a03e18] tg3_poll_msix at ffffffffa0165fbc [tg3]
#19 [ffff884894a03e68] net_rx_action at ffffffff81460b43