The crash is happening in the bowels of the slab allocator.
Specifically, it looks like it's hitting this:
/*
* The slab was either on partial or free list so
* there must be at least one object available for
* allocation.
*/
BUG_ON(slabp->inuse >= cachep->num);
...which looks like maybe the accounting of in-use objects is off. This
really sounds like some sort of memory corruption. I've not been able
to reproduce this so far, but I also had someone report panic here that
might be related:
https://bugzilla.redhat.com/show_bug.cgi?id=731278
One thing that might be helpful is turning on page poisoning and
redoing this test, that might make it crash sooner and point out the
source of the corruption.
Even better would be a bisect to track down the cause...