https://bugzilla.kernel.org/show_bug.cgi?id=207383
--- Comment #83 from Christian König (christian.koenig@amd.com) --- Instead of working around the bug I think we should concentrate on nailing the root cause.
I suggest to insert an use after free check into just that structure. In other words add a field "magic_number" will it with 0xdeadbeef on allocation and set it to zero before the kfree().
A simple BUG_ON(ptr->magic_number != 0xdeadbeef) should yield results rather quickly.
Then just add printk()s before the kfree() to figure out why we have this use after free race.