Hi Jeremy,
I've seen a number of oops reports similar to this, and it appears that
something is freeing a dentry or inode when it's still in use. Then the
next call that finds the dentry on a list, typically select_dcache or
do_follow_link, gets a trash pointer and oopses.
I haven't been able to see a common cause to focus a search for the
problem, but things to look for would be an extra dput() or iput() when
there's a remaining reference to the dentry or inode.
Regards,
Bill