Comment 6 for bug 264571

Here is a hand-copy of the trace from the final screen after the crash. Let me know if more of it would be useful; I'm hoping someone will recognise some of the calls and suggest where I can look for a solution.

[1042.304010] Process usplash(pid:6903, thread inf ffff88004611c000, task ffff88004457d9c0)
  Stack: {12 16-character strings)
  Call Trace:
  [<ffffffff80236cba>] phys_mem_access_prot_allowed+0xba/0x170
  [<ffffffff803a90b8>] ? rb_insert_color+0x98/0x140
  [<ffffffff804020f7>] mmap_mem+0x87/0x150
  [<ffffffff802c8909>] mmap_region+0x239/0x5d0
  [<ffffffff802c9184>] do_mmap_pgoff+0x3f4/0x140
  [<ffffffff8021794e>] sym_mmap+0x10e/0x140
  [<ffffffff8021288a>] system_call_fastpath+0x16/0x1b
{2 blank lines}
  Code: d0 48 8b 15.........(64 pairs)
  RIP [<ffffffff8023691e>] reserve_memtype+0x3be/0x590
  RSP <ffff88004611dd28>
  ---[ end trace deaa26b049b58b26 ]---

{all lines have same timestamp at start - [1042.304010] }

The top may or may not be lost - no way to scroll back up screen as far as I can tell.......

The memory addresses are different for each crash; the instructions seem to be the same, and I think the code is also.