Kernel panic in kfree() due to a bug in __sg_alloc_table()

Issue

• System crashed with following messages:

kernel BUG at mm/slab.c:524!
-    2.6.32-642.11.1.el6.x86_64
Call Trace:
[<ffffffff8113ca60>] ? __free_pages+0x60/0xa0
[<ffffffff812aa1d0>] ? sg_kfree+0x0/0x30
[<ffffffff812aa1e1>] sg_kfree+0x11/0x30
[<ffffffff812a98a0>] __sg_free_table+0x60/0x80
[<ffffffff812aa1d0>] ? sg_kfree+0x0/0x30
[<ffffffff812a9fe1>] sg_alloc_table+0x41/0x50
[<ffffffffa0421731>] ib_get_umem+0x231/0x5e0 [ib_core]
[<ffffffffa0139ccd>] ? mlx5_cmd_exec+0x1d/0x20 [mlx5_core]
[<ffffffffa0421b20>] ib_umem_get+0x40/0x44 [ib_core]
[<ffffffffa0505a90>] mlx5_ib_reg_user_mr+0x60/0x6b0 [mlx5_ib]
[<ffffffffa051f9dd>] ? __idr_get_uobj+0x7d/0x90 [ib_uverbs]
[<ffffffffa052436a>] ib_uverbs_reg_mr+0x16a/0x2b0 [ib_uverbs]
[<ffffffffa051e6a2>] ib_uverbs_write+0x2f2/0x330 [ib_uverbs]
[<ffffffff811e2074>] ? ep_poll+0x314/0x350
[<ffffffff81151d1c>] ? sys_madvise+0x2fc/0x790
[<ffffffff812390f6>] ? security_file_permission+0x16/0x20
[<ffffffff8119801d>] ? rw_verify_area+0x5d/0xc0
[<ffffffff81198138>] vfs_write+0xb8/0x1a0
[<ffffffff81199626>] ? fget_light_pos+0x16/0x50
[<ffffffff81198c71>] sys_write+0x51/0xb0
[<ffffffff8100b0d2>] system_call_fastpath+0x16/0x1b
RIP  [<ffffffff8117fe0c>] kfree+0x29c/0x320