OpenAFS module lead to panic on Red Hat Enterprise Linux 5 due to slab corruption on names_cache.

Issue

• Frequent kernel panic with following log messages.

NMI Watchdog detected LOCKUP on CPU 8    
CPU 8 
Modules linked in: nfs fscache nfs_acl autofs4 ipmi_devintf ipmi_si ipmi_msghandler hidp rfcomm l2cap bluetooth lockd sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf bonding be2iscsi ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp bnx2i cnic ipv6 xfrm_nalgo crypto_api uio cxgb3i cxgb3 libiscsi_tcp libiscsi2 scsi_transport_iscsi2 scsi_transport_iscsi dm_round_robin dm_multipath scsi_dh video backlight sbs power_meter hwmon i2c_ec dell_wmi wmi button battery asus_acpi acpi_memhotplug ac openafs(PU) exportfs parport_pc lp parport joydev sr_mod i2c_i801 ide_cd lpfc be2net cdrom bnx2 i2c_core i7core_edac tpm_tis tpm tpm_bios edac_mc 8021q pcspkr sg scsi_transport_fc dm_raid45 dm_message dm_region_hash dm_mem_cache dm_snapshot dm_zero dm_mirror dm_log dm_mod cciss usb_storage ata_piix libata mptsas mptscsih scsi_transport_sas mptbase shpchp megaraid_sas sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 14305, comm: adclient Tainted: P      2.6.18-238.12.1.el5 #1
RIP: 0010:[<ffffffff80157c06>]  [<ffffffff80157c06>] list_del+0xb/0x71
RSP: 0018:ffff81086768fd78  EFLAGS: 00000082
RAX: ffff810880024640 RBX: ffff810f2ef96c80 RCX: ffff81086768fe48
RDX: ffff810f2ef96c80 RSI: ffff810880024640 RDI: ffff810f2ef96c80
RBP: ffff810f2ef96c80 R08: ffff81089c1c98c0 R09: ffff81089c15bc00
R10: 00000000000007dc R11: 0000000000000246 R12: ffff81089c1c98c0
R13: ffff810880024640 R14: 000000000000000c R15: ffff8128800261c0
FS:  0000000040e64940(0063) GS:ffff81089c2520c0(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f7f4e000 CR3: 0000000867ac0000 CR4: 00000000000006e0
Process adclient (pid: 14305, threadinfo ffff81086768e000, task ffff81087f4c4100)
Stack:  0000000000000246 ffffffff8005c37c 000000d07fa6c7c0 0000000000000246
 00000000000000d0 ffff8128800261c0 0000000000000001 00000000ffffff9c
 00002ac0d133a1a1 ffffffff8000ad00 fffffffffffffff4 ffff81086768fef8
Call Trace:
 [<ffffffff8005c37c>] cache_alloc_refill+0xf1/0x186
 [<ffffffff8000ad00>] kmem_cache_alloc+0x6c/0x76
 [<ffffffff8001283a>] getname+0x25/0x1c2
 [<ffffffff80023ad6>] __user_walk_fd+0x19/0x4c
 [<ffffffff80028a45>] vfs_stat_fd+0x1b/0x4a
 [<ffffffff8008e430>] default_wake_function+0x0/0xe
 [<ffffffff80023826>] sys_newstat+0x19/0x31
 [<ffffffff8005d229>] tracesys+0x71/0xe0
 [<ffffffff8005d28d>] tracesys+0xd5/0xe0


Code: 48 39 fa 74 1b 48 89 fe 31 c0 48 c7 c7 8e 3f 2c 80 e8 91 bc