kernel crashes with instruction pointer at "rb_erase+0x1fb/0x390" if [intel|amd]_iommu=on and TSO with bnx2x driver are enabled.

Issue

• Red Hat Enterprise Linux 7 system crashed due to kernel panic

BUG: unable to handle kernel NULL pointer dereference at           (null)
...
RIP: 0010:[<ffffffff812bf01b>]  [<ffffffff812bf01b>] rb_erase+0x1fb/0x390
..

• When TSO (TCP segmentation offload) is enabled in network setting

$ ethtool -k eth0
Features for eth0:
tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: on
    tx-tcp6-segmentation: on

• And "[intel|amd]_iommu=on" is used as the boot parameter (/boot/grub2/grub.cfg)

linux16 /boot/vmlinuz-3.10.0-123.el7.x86_64 root=/dev/sda5  intel_iommu=on  crashkernel=130M@0M ro rhgb quiet LANG=en_US.UTF-8