Can you please enable CONFIG_SLUB_DEBUG=y and CONFIG_SLUB_DEBUG_ON=yHi,
and give it another try?
If we can not catch it that way, I'll whip up a patch which points us
to the code which added the offending timer.
Note: I switched to 2.6.25-rc2. The only new thing I see is this message:
hci_cmd_task: hci0 command tx timeout
This comes from net/bluetooth/hci_core.c, line 1547
There is indeed a timeout message in the log (at the end of this
email). I tried to boot with slub_debug but did not get anything
more. slabinfo -v does not report anything either.
Crash log:
hci_cmd_task: hci0 command tx timeout
BUG: unable to handle kernel paging request at 6b6b6b6b
We got some more info ---------------------------^^^^^^^^
#define POISON_FREE 0x6b /* for use-after-free poisoning */
So the timer is in an allocated data structure, which is
freed without having removed the timer first.
Sorry for the meager yield.
Hey, we know already more :)
Marcel, any idea on this one ?