RHEL5: Panic with list corruption called from free_block in kmem cache memory reclaim code

Issue

• single instance of the following panic, signalling list corruption in the following call tree: cache_reap -> drain_array -> free_block

list_add corruption. prev->next should be ffff81102eec1640, but was ffff810fd393b000
----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at lib/list_debug.c:31
invalid opcode: 0000 [1] SMP
last sysfs file: /devices/pci0000:00/0000:00:01.0/0000:03:00.0/0000:04:01.0/0000:07:00.0/0000:08:00.0/irq
CPU 14
Modules linked in: mptctl mptbase sg ipmi_si(U) ipmi_devintf(U) ipmi_msghandler(U) hpilo(U) nfs lockd fscache nfs_acl sunrpc ib_iser(U) iscsi_tcp(U) libiscsi(U) scsi_transport_iscsi(U) rdma_ucm(U) rds(U) ib_ucm(U) ib_sdp(U) rdma_cm(U) iw_cm(U) ib_addr(U) ib_ipoib(U) ipoib_helper(U) ib_cm(U) ib_sa(U) ipv6 xfrm_nalgo crypto_api ib_uverbs(U) ib_umad(U) mlx4_ib(U) ib_mthca(U) ib_mad(U) ib_core(U) dm_mirror dm_multipath dm_mod video sbs backlight i2c_ec i2c_core button battery asus_acpi acpi_memhotplug ac parport_pc lp parport e1000e(U) ide_cd mlx4_core(U) shpchp serio_raw cdrom bnx2(U) pcspkr ata_piix libata cciss(U) sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 64, comm: events/14 Tainted: G      2.6.18-92.el5 #1
RIP: 0010:[<ffffffff801468aa>]  [<ffffffff801468aa>] __list_add+0x48/0x68
RSP: 0018:ffff81102fa6bd70  EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff81102eec1640 RCX: ffffffff802ec9a8
RDX: ffffffff802ec9a8 RSI: 0000000000000000 RDI: ffffffff802ec9a0
RBP: ffff81102ef5f000 R08: ffffffff802ec9a8 R09: 0000000000000046
R10: 0000000000000000 R11: 0000000000000280 R12: ffff810fd393b000
R13: ffff81102f7e0018 R14: ffff810fd393b6e0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff81102fcb1540(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00002b8662a730a0 CR3: 000000101c587000 CR4: 00000000000006e0
Process events/14 (pid: 64, threadinfo ffff81102fa6a000, task ffff81102fa3a860)
Stack:  ffff810fd393b000 ffff81102eec1640 ffff81102eedd080 ffffffff800d3bb2
0000000200000000 ffff81102f7e0018 0000000000000002 ffff81102f7e0000
0000000000000000 ffff81102eec1640 ffff81102eedd080 ffffffff800d3c5c
Call Trace:
[<ffffffff800d3bb2>] free_block+0x11c/0x13b
[<ffffffff800d3c5c>] drain_array+0x8b/0xc0
[<ffffffff800d46a9>] cache_reap+0x0/0x219
[<ffffffff800d474e>] cache_reap+0xa5/0x219
[<ffffffff8004cea9>] run_workqueue+0x94/0xe4
[<ffffffff800497be>] worker_thread+0x0/0x122
[<ffffffff800498ae>] worker_thread+0xf0/0x122
[<ffffffff8008ac03>] default_wake_function+0x0/0xe
[<ffffffff8003253d>] kthread+0xfe/0x132
[<ffffffff8005dfb1>] child_rip+0xa/0x11
[<ffffffff8003243f>] kthread+0x0/0x132
[<ffffffff8005dfa7>] child_rip+0x0/0x11

Code: 0f 0b 68 07 cb 29 80 c2 1f 00 4c 89 63 08 49 89 1c 24 4c 89
RIP  [<ffffffff801468aa>] __list_add+0x48/0x68
RSP <ffff81102fa6bd70>