I just encountered the bug on another machine (previous was named nec, new is nas2).  nas2 is a gutsy server.  I assure that while I may had have doubt about nec's hardware (faulty memory), I doubt that two of my machines could have defective memory at the same time.  My NAS servers (nas1,nas2,nas3) were all very stable for the last years with uptimes of months.  Ok upgrading to gutsy may seem dumb, I know, but I wanted a newer kernel with better encryption/jfs support.  Anyway, now we have this kernel bug and I think it's critical.  I'm not the only people having it.

So far, I've seen this bug in kernel 2.6.22-14-server, 2.6.22-14-generic and 2.6.22-13-generic.

[436307.718390] Eeek! page_mapcount(page) went negative! (-1)
[436307.718452]   page pfn = 12f11
[436307.718471]   page->flags = 4001002c
[436307.718490]   page->count = 1
[436307.718508]   page->mapping = c78ade8c
[436307.718548]   vma->vm_ops = generic_file_vm_ops+0x0/0x18
[436307.718592]   vma->vm_ops->nopage = filemap_nopage+0x0/0x330
[436307.718622]   vma->vm_file->f_op->mmap = generic_file_mmap+0x0/0x40
[436307.718719] ------------[ cut here ]------------
[436307.718743] kernel BUG at /build/buildd/linux-source-2.6.22-2.6.22/mm/rmap.c:628!
[436307.718780] invalid opcode: 0000 [#1]
[436307.718799] SMP 
[436307.718819] Modules linked in: jfs sha256 cbc blkcipher aes_i586 aes dm_crypt dm_mod fuse lp sg sd_mod i2c_viapro via686a pcspkr i2c_isa i2c_core via_agp parport_pc parport agpgart shpchp pci_hotplug ipv6 evdev ext3 jbd mbcache ide_cd cdrom ide_disk floppy 3c59x mii sata_sil uhci_hcd usbcore via82cxxx ide_core ata_generic libata scsi_mod raid10 raid456 xor raid1 raid0 multipath linear md_mod thermal processor fan capability commoncap
[436307.719076] CPU:    0
[436307.719079] EIP:    0060:[<c0173779>]    Not tainted VLI
[436307.719084] EFLAGS: 00010282   (2.6.22-14-server #1)
[436307.719161] EIP is at page_remove_rmap+0xe9/0x100
[436307.719187] eax: 0000004b   ebx: c125e220   ecx: 00000046   edx: 00000000
[436307.719217] esi: c0a3b5d8   edi: c125e220   ebp: b7ee2000   esp: c0cc9e9c
[436307.719246] ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
[436307.719277] Process rsync (pid: 6228, ti=c0cc8000 task=d3d70000 task.ti=c0cc8000)
[436307.719307] Stack: c0383ba6 c78ade8c 00000020 c1cbb710 c016b6bf 12f11025 00000000 b7f41fff 
[436307.719364]        01cbb067 00000000 00000000 c0a3b5d8 c0cc9f44 00000000 00000000 12f11025 
[436307.719419]        00000000 00000000 00000001 b7f42000 d3e68010 d1d01540 c12872c0 00000000 
[436307.719475] Call Trace:
[436307.719509]  [<c016b6bf>] unmap_vmas+0x43f/0x6f0
[436307.719574]  [<c01700b8>] exit_mmap+0x78/0xf0
[436307.719611]  [<c0125c73>] mmput+0x33/0xa0
[436307.719648]  [<c012b15f>] do_exit+0x10f/0x800
[436307.719679]  [<c013387a>] do_sigaction+0x14a/0x1c0
[436307.719736]  [<c012b876>] do_group_exit+0x26/0x80
[436307.719770]  [<c010418a>] sysenter_past_esp+0x6b/0xa1
[436307.719822]  =======================
[436307.719843] Code: c0 74 0d 8b 50 08 b8 c4 2b 38 c0 e8 02 95 fd ff 8b 46 4c 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 e4 2b 38 c0 e8 e7 94 fd ff <0f> 0b eb fe 8b 53 0c eb 95 8d b4 26 00 00 00 00 8d bc 27 00 00 
[436307.720023] EIP: [<c0173779>] page_remove_rmap+0xe9/0x100 SS:ESP 0068:c0cc9e9c
[436307.720336] Fixing recursive fault but reboot is needed!
[436307.720394] BUG: scheduling while atomic: rsync/0x00000001/6228
[436307.720454]  [<c02fa016>] schedule+0x4e6/0x8c0
[436307.720585]  [<c012b7ad>] do_exit+0x75d/0x800
[436307.720676]  [<c02537ab>] set_palette+0x2b/0x60
[436307.720781]  [<c021b314>] vgacon_blank+0x364/0x7e0
[436307.720895]  [<c010585f>] die+0x25f/0x260
[436307.720995]  [<c0105b80>] do_invalid_op+0x0/0x90
[436307.721087]  [<c0105c01>] do_invalid_op+0x81/0x90
[436307.721186]  [<c0173779>] page_remove_rmap+0xe9/0x100
[436307.721280]  [<c0127e63>] __call_console_drivers+0x53/0x60
[436307.721377]  [<c0128297>] release_console_sem+0x1c7/0x1f0
[436307.721494]  [<c02fc09a>] error_code+0x72/0x78
[436307.721594]  [<c0173779>] page_remove_rmap+0xe9/0x100
[436307.721693]  [<c016b6bf>] unmap_vmas+0x43f/0x6f0
[436307.721818]  [<c01700b8>] exit_mmap+0x78/0xf0
[436307.721918]  [<c0125c73>] mmput+0x33/0xa0
[436307.722009]  [<c012b15f>] do_exit+0x10f/0x800
[436307.722100]  [<c013387a>] do_sigaction+0x14a/0x1c0
[436307.722207]  [<c012b876>] do_group_exit+0x26/0x80
[436307.722302]  [<c010418a>] sysenter_past_esp+0x6b/0xa1
[436307.722411]  =======================