On Thu, 2006-08-10 at 15:45 -0400, Chuck Lever wrote:
> Yeah.  I'd say something is overwriting i_cdev with garbarge.  Then
> __fput sees that i_cdev is not NULL and tries to call cdev_put with a
> bogus address.

Looks like something is calling fput() on a file pointing to an inode
that has already been freed. 6b6b6b6b is the mark of the poisoned slab
entry.

Hmm.... Does the attached patch fix it for you?

Cheers,
  Trond