Hmm, looks like it might be a use-after-free bug (6b is the slab's
poison value):
    Christian> RAX: 6b6b6b6b6b6b6b6b
Are you running with CONFIG_DEBUG_SLAB enabled?
Also can you send the output of "objdump -d" on uverbs_mem.o from your
kernel compile?
 - R.