Panic when dereferencing a broken linked list (backing device IO list) caused by snumbd26 module

Issue

• System crashes with a kernel panic with following kernel messages:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
IP: [<ffffffff811a0a56>] writeback_inodes_wb+0xf6/0x1b0
PGD 10d271067 PUD 21aea6067 PMD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/cpu7/cpufreq/scaling_setspeed
CPU 5 
Modules linked in: nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables bridge nfs lockd nfs_acl auth_rpcgss snumbd26(P)(U) snapapi26(P)(U) autofs4 sunrpc target_core_iblock target_core_file target_core_pscsi target_core_mod configfs bnx2fc cnic uio fcoe libfcoe libfc 8021q garp stp llc pcc_cpufreq cachefiles fscache(T) dsa_filter(P)(U) ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_round_robin dm_multipath uinput microcode serio_raw amd64_edac_mod edac_core edac_mce_amd i2c_piix4 i2c_core sg tg3 hpilo hpwdt power_meter shpchp ext4 mbcache jbd2 sd_mod crc_t10dif sr_mod cdrom qla2xxx scsi_transport_fc scsi_tgt hpsa ata_generic pata_acpi pata_atiixp ahci dm_mirror dm_region_hash dm_log dm_mod [last unloaded: nf_defrag_ipv4]

Pid: 169, comm: bdi-default Tainted: P        W  ---------------- T 2.6.32-220.el6.x86_64 #1 HP ProLiant DL385p Gen8
RIP: 0010:[<ffffffff811a0a56>]  [<ffffffff811a0a56>] writeback_inodes_wb+0xf6/0x1b0
RSP: 0018:ffff880630059ca0  EFLAGS: 00010246
RAX: 0000000000000128 RBX: 0000000000000000 RCX: ffff88011c98b4b0
RDX: 000000000000be14 RSI: ffffffff81abda20 RDI: ffffffff81fbea00
RBP: ffff880630059cf0 R08: ffff880630059c50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff81abd9e0
R13: ffffffff81abda20 R14: ffffffff81fbea00 R15: ffff880630059d40
FS:  00007f8df03be700(0000) GS:ffff880c55480000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000128 CR3: 0000000124d49000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Process bdi-default (pid: 169, threadinfo ffff880630058000, task ffff8806307c20c0)
Stack:
 ffff880630059d00 ffffffff810096f0 ffff880c30de6a80 ffff88011c98b4a0
<0> 0000000000059d10 ffffffff81abd9e0 ffff880630059e20 0000000000000000
<0> ffffffff81fbf340 ffff880630059d40 ffff880630059df0 ffffffff811a0dab
Call Trace:
 [<ffffffff810096f0>] ? __switch_to+0xd0/0x320
 [<ffffffff811a0dab>] wb_writeback+0x29b/0x3f0
 [<ffffffff814eca40>] ? thread_return+0x4e/0x77e
 [<ffffffff811a1099>] wb_do_writeback+0x199/0x240
 [<ffffffff8107c200>] ? process_timeout+0x0/0x10
 [<ffffffff81134a9a>] bdi_forker_task+0x6a/0x310
 [<ffffffff81134a30>] ? bdi_forker_task+0x0/0x310
 [<ffffffff81090886>] kthread+0x96/0xa0
 [<ffffffff8100c14a>] child_rip+0xa/0x20
 [<ffffffff810907f0>] ? kthread+0x0/0xa0
 [<ffffffff8100c140>] ? child_rip+0x0/0x20