Jens, just got this crash on a testbox:

[   37.701628] warning: process `kmodule' used the removed sysctl system call with 1.23.
[   39.409390] BUG: unable to handle kernel paging request at virtual address 7ca76000
[   39.416892] printing eip: 78406669 *pde = 00dda027 *pte = 04a76000 
[   39.423132] Oops: 0000 [#1] DEBUG_PAGEALLOC
[   39.427292] 
[   39.428766] Pid: 431, comm: fsck.ext3 Not tainted (2.6.23 #45)
[   39.434571] EIP: 0060:[<78406669>] EFLAGS: 00010006 CPU: 0
[   39.440035] EIP is at blk_rq_map_sg+0xb9/0x170
[   39.444450] EAX: 04aed000 EBX: 7ca1f380 ECX: 04aee000 EDX: 00095da0
[   39.450689] ESI: 7ca75ff0 EDI: 79180da0 EBP: 00001000 ESP: 7caa1cac
[   39.456929]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[   39.462303] Process fsck.ext3 (pid: 431, ti=7caa0000 task=7ca80000 task.ti=7caa0000)
[   39.469841] Stack: 00000020 7b520000 00002000 04aef000 7ca75fe0 0000001f 00000001 00000000 
[   39.478161]        7ca1f300 01000002 7ca44980 7b522b94 7ca0de00 7b520000 784c89b5 7b520000 
[   39.486480]        784c843a 7ca0de00 7b520f20 7b522b94 7ca0de00 784e54a0 784f394b 00000000 
[   39.494799] Call Trace:
[   39.497400]  [<784c89b5>] scsi_init_io+0x55/0xe0
[   39.501992]  [<784c843a>] scsi_get_cmd_from_req+0x2a/0x40
[   39.507366]  [<784e54a0>] sd_prep_fn+0x80/0x940
[   39.511872]  [<784f394b>] ata_bmdma_start+0xb/0x20
[   39.516638]  [<784ef344>] ata_qc_issue_prot+0x164/0x1e0
[   39.521839]  [<78405c63>] elv_dispatch_sort+0x23/0xe0
[   39.526865]  [<784057d0>] elv_next_request+0xa0/0x130
[   39.531891]  [<787715b8>] _spin_lock_irq+0x38/0x50
[   39.536657]  [<784c9af4>] scsi_request_fn+0x1e4/0x370
[   39.541684]  [<78120e72>] del_timer+0x62/0x70
[   39.546016]  [<78408a45>] __generic_unplug_device+0x25/0x30
[   39.551563]  [<78408d15>] generic_unplug_device+0x15/0x30
[   39.556936]  [<78406430>] blk_backing_dev_unplug+0x0/0x10
[   39.562309]  [<7840643c>] blk_backing_dev_unplug+0xc/0x10
[   39.567682]  [<7818080d>] block_sync_page+0x2d/0x40
[   39.572535]  [<78144ee9>] sync_page+0x29/0x40
[   39.576868]  [<7876fdec>] __wait_on_bit_lock+0x3c/0x70
[   39.581981]  [<78144ec0>] sync_page+0x0/0x40
[   39.586227]  [<78144ea2>] __lock_page+0x52/0x60
[   39.590734]  [<7812ae90>] wake_bit_function+0x0/0x60
[   39.595674]  [<7814566c>] do_generic_mapping_read+0x21c/0x450
[   39.601393]  [<78144c30>] file_read_actor+0x0/0x130
[   39.606246]  [<78147227>] generic_file_aio_read+0x137/0x180
[   39.611793]  [<78144c30>] file_read_actor+0x0/0x130
[   39.616645]  [<78160d95>] do_sync_read+0xd5/0x120
[   39.621326]  [<78135cd8>] mark_held_locks+0x38/0x70
[   39.626179]  [<7812ae50>] autoremove_wake_function+0x0/0x40
[   39.631724]  [<787705b4>] mutex_lock_nested+0x1a4/0x200
[   39.636924]  [<78185611>] block_llseek+0x31/0xc0
[   39.641517]  [<787703a5>] __mutex_unlock_slowpath+0xb5/0x110
[   39.647150]  [<78135e1c>] trace_hardirqs_on+0x9c/0xb0
[   39.652177]  [<78160cc0>] do_sync_read+0x0/0x120
[   39.656770]  [<7816165b>] vfs_read+0xbb/0x120
[   39.661103]  [<78161a41>] sys_read+0x41/0x70
[   39.665349]  [<781028a2>] syscall_call+0x7/0xb
[   39.669769]  =======================
[   39.673322] Code: 05 c1 e1 0c 03 4a 08 8b 52 04 01 ca 89 54 24 0c 8b 3b 89 fa 29 c2 89 d0 c1 f8 05 c1 e0 0c 03 43 08 39 44 24 0c 0f 84 7e 00 00 00 <8b> 46 10 8d 56 10 a8 01 75 4c 89 3e 89 6e 0c 8b 43 08 89 46 04 

config and full bootlog attached.

i tried another bootup with the same kernel and the crash did not 
reoccur, so it seems to be spurious. This crash could be related to the 
scsi or block merges done in the past few days - never saw this before.

	Ingo