Hmm, I must of don't something wrong last time. I reran the regression tests for kicks and ran into this with fork-cow (aioalloc seemed to have completed ok this time): ./run.sh 5 ./fork-cow online 8 (0x40000000) online 9 (0x48000000) online 10 (0x50000000) online 11 (0x58000000) online 12 (0x60000000) online 13 (0x68000000) online 14 (0x70000000) online 15 (0x78000000) online 16 (0x80000000) online 17 (0x88000000) online 18 (0x90000000) online 19 (0x98000000) online 20 (0xa0000000) online 21 (0xa8000000) online 22 (0xb0000000) online 23 (0xb8000000) online 24 (0xc0000000) online 25 (0xc8000000) online 26 (0xd0000000) online 27 (0xd8000000) online 28 (0xe0000000) online 29 (0xe8000000) online 30 (0xf0000000) online 8 (0x40000000) online 9 (0x48000000) online 10 (0x50000000) pfn_to_page() pfn: 00040000 phys_section: 8 mem_section: 65535 has no mem_map kernel BUG at mm/nonlinear.c:153! invalid operand: 0000 [#1] PREEMPT SMP Modules linked in: CPU: 1 EIP: 0060:[<c0167501>] Not tainted VLI EFLAGS: 00010086 (2.6.10-rc2-mm4-mhp3) EIP is at pfn_to_page+0x71/0x90 eax: 00000051 ebx: 00040000 ecx: 00000000 edx: 00000001 esi: 00000008 edi: c03d2790 ebp: 00000000 esp: dea11dec ds: 007b es: 007b ss: 0068 Process sh (pid: 8418, threadinfo=dea10000 task=dfb80aa0) Stack: c039079c c037afa1 00040000 00000008 0000ffff 00000000 c03d2680 c0149b23 00040000 c1020000 c03d2300 00000000 c03d2480 c1020000 00000086 c03d2780 c03d2680 00000001 00000001 c014a16a c03d2680 00000000 c03d2790 00000000 Call Trace: [<c0149b23>] free_pages_bulk+0x23/0xe0 [<c014a16a>] __drain_pages+0x4a/0xa0 [<c014a2b7>] drain_local_pages+0x17/0x30 [<c014a5e7>] capture_page_range+0x77/0x1a0 [<c0167cf0>] __remove_pages+0x40/0xe2 [<c0281f25>] memory_block_action+0x105/0x1b0 [<c028201f>] memory_block_change_state+0x4f/0x60 [<c028211e>] store_mem_state+0xee/0x140 [<c027d1d5>] sysdev_store+0x35/0x40 [<c01a50fe>] flush_write_buffer+0x3e/0x50 [<c01a5184>] sysfs_write_file+0x74/0x90 [<c016b678>] vfs_write+0xc8/0x170 [<c016b7f1>] sys_write+0x51/0x80 [<c0103553>] syscall_call+0x7/0xb Code: 5c 24 14 83 c4 1c c3 8d 76 00 89 54 24 10 b9 a1 af 37 c0 89 74 24 0c 89 5c 24 08 89 4c 24 04 c7 04 24 9c 07 39 c0 e8 9f a7 fb ff <0f> 0b 99 00 f3 12 39 c0 0f b7 84 36 80 f6 4b c0 eb a7 8d b6 00 ------------[ cut here ]------------ Fatal exception: panic in 5 seconds scheduling while atomic: sh/0x00000001/8418 [<c0375c12>] schedule+0x792/0x7a0 [<c0376a4a>] _spin_lock+0x1a/0x70 [<c012bc42>] __mod_timer+0xf2/0x150 [<c0104c40>] do_invalid_op+0x0/0xd0 [<c0376232>] schedule_timeout+0x72/0xd0 [<c012c870>] process_timeout+0x0/0x10 [<c0104c40>] do_invalid_op+0x0/0xd0 [<c0121cb7>] printk+0x17/0x20 [<c0104855>] die+0x165/0x180 [<c0104cf2>] do_invalid_op+0xb2/0xd0 [<c0167501>] pfn_to_page+0x71/0x90 [<c011c521>] __wake_up_common+0x41/0x70 [<c011c58e>] __wake_up+0x3e/0x60 [<c0121f38>] release_console_sem+0xb8/0xc0 [<c010401b>] error_code+0x2b/0x30 [<c0167501>] pfn_to_page+0x71/0x90 [<c0149b23>] free_pages_bulk+0x23/0xe0 [<c014a16a>] __drain_pages+0x4a/0xa0 [<c014a2b7>] drain_local_pages+0x17/0x30 [<c014a5e7>] capture_page_range+0x77/0x1a0 [<c0167cf0>] __remove_pages+0x40/0xe2 [<c0281f25>] memory_block_action+0x105/0x1b0 [<c028201f>] memory_block_change_state+0x4f/0x60 [<c028211e>] store_mem_state+0xee/0x140 [<c027d1d5>] sysdev_store+0x35/0x40 [<c01a50fe>] flush_write_buffer+0x3e/0x50 [<c01a5184>] sysfs_write_file+0x74/0x90 [<c016b678>] vfs_write+0xc8/0x170 [<c016b7f1>] sys_write+0x51/0x80 [<c0103553>] syscall_call+0x7/0xb kernel BUG at mm/nonlinear.c:153! invalid operand: 0000 [#2] PREEMPT SMP Modules linked in: CPU: 0 EIP: 0060:[<c0167501>] Not tainted VLI EFLAGS: 00010086 (2.6.10-rc2-mm4-mhp3)