Comment # 4 on bug 92258 from Christian König

The crash looks like the TTM cleanup process tries to free a buffer twice.

Most likely a bug in the reference counting somewhere. Can you try to bisect
the DRM changes between 4.1.6 and 4.1.7?

According to the git logs there wasn't even a single change radeon between
4.1.6 and 4.1.7 so this sounds like a problem in TTM.