System panic has occurred via ext3_readdir()

Issue

• A system panic has occurred on RHEL6.4 system.
• This issue causes size-64 slab area corruption.
• According to the panic log, each the panic was detected via ext3_readdir().
• The panic occurred when ext3_readdir() walked a "struct rb_node". The root node was referenced by "root" member of "struct dir_private_info".
• The problem was that the dir_private_info->root.rb_node was not a pointer to "struct rb_node" but to "prev" member of "struct slab".
• ext3_readdir() handled the "struct slab" as "struct rb_node", so the system panic occurred.
• Why the dir_private_info->root.rb_node pointed to "struct slab"?