Kernel panic with `list_del corruption` after `WARNING: at lib/kref.c:32 kref_get()`

Issue

• Kernel panic with list_del corruption after WARNING: at lib/kref.c:32 kref_get()

nfsd: last server has exited
nfsd: unexporting all filesystems
NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory
NFSD: starting 90-second grace period
NFSD: setclientid: string in use by client(clientid 50a7591f/00000009)
NFSD: setclientid: string in use by client(clientid 50a7591f/0000005d)
NFSD: setclientid: string in use by client(clientid 50a7591f/000001b7)
NFSD: setclientid: string in use by client(clientid 50a7591f/000001ba)
NFSD: setclientid: string in use by client(clientid 50a7591f/000001bc)
WARNING: at lib/kref.c:32 kref_get()

Call Trace:
 [<ffffffff80036d06>] kref_get+0x2e/0x33
 [<ffffffff887bd912>] :nfsd:find_file+0x61/0x7e
 [<ffffffff887beba7>] :nfsd:nfsd4_process_open2+0x51/0x968
 [<ffffffff8000985a>] __d_lookup+0xb0/0xff
 [<ffffffff80036c0a>] __lookup_hash+0x61/0x12f
 [<ffffffff800eb2fa>] lookup_one_len+0x53/0x61
 [<ffffffff8009d2c8>] set_current_groups+0x116/0x164
 [<ffffffff8000db08>] permission+0x81/0xc8
 [<ffffffff887aa16a>] :nfsd:nfsd_permission+0xbb/0x10a
 [<ffffffff887a9c78>] :nfsd:fh_verify+0x463/0x4cf
 [<ffffffff8000d5a8>] dput+0x2c/0x114
 [<ffffffff887b6a7f>] :nfsd:nfsd4_proc_compound+0xbc0/0x147d
 [<ffffffff80046c44>] try_to_wake_up+0x472/0x484
 [<ffffffff8008cc7c>] __wake_up_common+0x3e/0x68
 [<ffffffff8002dfd7>] __wake_up+0x38/0x4f
 [<ffffffff8872b283>] :sunrpc:svc_sock_enqueue+0x206/0x247
 [<ffffffff8872cd0a>] :sunrpc:svc_tcp_recvfrom+0x719/0x79e
 [<ffffffff80062ff2>] thread_return+0x62/0xfe
 [<ffffffff8872d61c>] :sunrpc:ip_map_match+0x19/0x30
 [<ffffffff88730f3b>] :sunrpc:sunrpc_cache_lookup+0x4b/0x128
 [<ffffffff887b9386>] :nfsd:nfsd4_decode_compound+0x324/0xdda
 [<ffffffff887a71db>] :nfsd:nfsd_dispatch+0xd8/0x1d6
 [<ffffffff8872a7b9>] :sunrpc:svc_process+0x44c/0x713
 [<ffffffff80064614>] __down_read+0x12/0x92
 [<ffffffff887a7580>] :nfsd:nfsd+0x0/0x2c8
 [<ffffffff887a7725>] :nfsd:nfsd+0x1a5/0x2c8
 [<ffffffff8005dfb1>] child_rip+0xa/0x11
 [<ffffffff887a7580>] :nfsd:nfsd+0x0/0x2c8
 [<ffffffff887a7580>] :nfsd:nfsd+0x0/0x2c8
 [<ffffffff8005dfa7>] child_rip+0x0/0x11

list_del corruption. prev->next should be ffff810235a08bb8, but was ffff8103d8973338
----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at lib/list_debug.c:65
invalid opcode: 0000 [1] SMP 
last sysfs file: /devices/pci0000:00/0000:00:09.0/0000:03:00.0/host6/rport-6:0-3/target6:0:1/6:0:1:5/timeout
CPU 0 
Modules linked in: md5 af_key nfsd exportfs nfs_acl auth_rpcgss dm_log_clustered(U) lockd sunrpc bonding ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_addr iscsi_tcp bnx2i cnic uio cxgb3i libcxgbi iw_cxgb3 ib_core cxgb3 libiscsi_tcp libiscsi2 scsi_transport_iscsi2 scsi_transport_iscsi ipv6 xfrm_nalgo crypto_api dm_round_robin dm_multipath scsi_dh video backlight sbs power_meter hwmon i2c_ec dell_wmi wmi button battery asus_acpi acpi_memhotplug ac parport_pc lp parport sr_mod cdrom st igb i2c_i801 8021q tpm_tis i2c_core i7core_edac serio_raw tpm floppy edac_mc tpm_bios dca sg pcspkr dm_raid45 dm_message dm_region_hash dm_mem_cache dm_snapshot dm_zero dm_mirror dm_log dm_mod usb_storage lpfc scsi_transport_fc ata_piix libata shpchp megasr(PU) sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 12016, comm: nfsd Tainted: P     ---- 2.6.18-274.el5 #1
RIP: 0010:[<ffffffff80158af7>]  [<ffffffff80158af7>] list_del+0x21/0x6b
RSP: 0018:ffff81044e3579e0  EFLAGS: 00010286
RAX: 0000000000000058 RBX: ffff810235a08ba8 RCX: 0000000000000282
RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff8031df5c
RBP: 0000000000000004 R08: 0000000000000010 R09: 0000000000000030
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8103670551c0
R13: ffff81044e357e08 R14: ffff8102e24d0000 R15: ffff81083b015800
FS:  00002ae5ca3d26e0(0000) GS:ffffffff8042a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002aaaac005000 CR3: 000000083c85d000 CR4: 00000000000006a0
Process nfsd (pid: 12016, threadinfo ffff81044e356000, task ffff81083f77b860)
Stack:  ffff81044e357e08 ffffffff887bcf66 ffff81083d00c1f4 ffff81083d00c1f0
 0000000000000000 ffffffff887bfa1d 000000003e705a00 ffff81083d00c080
 ffff810235a08ba8 ffff81083d6b8000 ffffffff887d3b38 ffff81043e097a00
Call Trace:
 [<ffffffff887bcf66>] :nfsd:release_stateid+0x1b/0x9c
 [<ffffffff887bfa1d>] :nfsd:nfsd4_close+0xa0/0x122
 [<ffffffff887b615a>] :nfsd:nfsd4_proc_compound+0x29b/0x147d
 [<ffffffff88702f8a>] :bonding:bond_dev_queue_xmit+0x1c0/0x1e4
 [<ffffffff800303b8>] sock_recvmsg+0xfd/0x155
 [<ffffffff88704b15>] :bonding:bond_xmit_activebackup+0x104/0x121
 [<ffffffff801546d1>] __next_cpu+0x19/0x28
 [<ffffffff800778c5>] smp_send_reschedule+0x4e/0x53
 [<ffffffff8008e202>] enqueue_task+0x41/0x56
 [<ffffffff80046c44>] try_to_wake_up+0x472/0x484
 [<ffffffff8008cc7c>] __wake_up_common+0x3e/0x68
 [<ffffffff8002dfd7>] __wake_up+0x38/0x4f
 [<ffffffff8872b283>] :sunrpc:svc_sock_enqueue+0x206/0x247
 [<ffffffff8872cd0a>] :sunrpc:svc_tcp_recvfrom+0x719/0x79e
 [<ffffffff80062ff2>] thread_return+0x62/0xfe
 [<ffffffff8008e26d>] __activate_task+0x56/0x6d
 [<ffffffff8872d61c>] :sunrpc:ip_map_match+0x19/0x30
 [<ffffffff88730f3b>] :sunrpc:sunrpc_cache_lookup+0x4b/0x128
 [<ffffffff887b9386>] :nfsd:nfsd4_decode_compound+0x324/0xdda
 [<ffffffff887a71db>] :nfsd:nfsd_dispatch+0xd8/0x1d6
 [<ffffffff8872a7b9>] :sunrpc:svc_process+0x44c/0x713
 [<ffffffff80064614>] __down_read+0x12/0x92
 [<ffffffff887a7580>] :nfsd:nfsd+0x0/0x2c8
 [<ffffffff887a7725>] :nfsd:nfsd+0x1a5/0x2c8
 [<ffffffff8005dfb1>] child_rip+0xa/0x11
 [<ffffffff887a7580>] :nfsd:nfsd+0x0/0x2c8
 [<ffffffff887a7580>] :nfsd:nfsd+0x0/0x2c8
 [<ffffffff8005dfa7>] child_rip+0x0/0x11