I've found what's going on there.  Basically, we should not use
__user_walk() with LOOKUP_PARENT - nd->last.name is set to the last
component of the name and freeing that name before we are done is not a
good idea.