Christoph, I've been reading the code and spotted two potential issues in
__slab_free(). The first one seems like an off-by-one where our comparison
in deactivate_slab() doesn't match __slab_free.
The other one is remove_full() call in __slab_free() that can get called
even if cache debugging is not enabled.
Hmm?
I'd like to do -rc1 today, regardless of whether this fixes things or
not (-rc1 is already a few days delayed).
The patch seems to be a good fix, and a likely candidate for the
corruption. Commit log and sign-off? I assume you've given it some
testing, even if you couldn't reproduce the original issue?