I added bootmem_debug=1 to kernel cmdline, got following messages:

---
bootmem::init_bootmem_core nid=0 start=80000 map=80773 end=9cf00 mapsize=39e0
bootmem::mark_bootmem_node nid=0 start=80000 end=9cf00 reserve=0 flags=0
bootmem::__free nid=0 start=80000 end=9cf00
bootmem::mark_bootmem_node nid=0 start=80773 end=80777 reserve=1 flags=0
bootmem::__reserve nid=0 start=80773 end=80777 flags=0
bootmem::mark_bootmem_node nid=0 start=80008 end=80773 reserve=1 flags=0
bootmem::__reserve nid=0 start=80008 end=80773 flags=0
bootmem::mark_bootmem_node nid=0 start=80004 end=80008 reserve=1 flags=0
bootmem::__reserve nid=0 start=80004 end=80008 flags=0
bootmem::alloc_bootmem_core nid=0 size=3a0000 [928 pages] align=20 goal=bfffffff limit=0
bootmem::__reserve nid=0 start=80777 end=80b17 flags=1
bootmem::alloc_bootmem_core nid=0 size=2c [1 pages] align=20 goal=bfffffff limit=0
bootmem::__reserve nid=0 start=80b17 end=80b18 flags=1
bootmem::alloc_bootmem_core nid=0 size=2000 [2 pages] align=20 goal=bfffffff limit=0
bootmem::__reserve nid=0 start=80b18 end=80b1a flags=1
bootmem::alloc_bootmem_core nid=0 size=1000 [1 pages] align=1000 goal=0 limit=ffffffff
bootmem::__reserve nid=0 start=80b1a end=80b1b flags=1
bootmem::alloc_bootmem_core nid=0 size=1000 [1 pages] align=1000 goal=0 limit=ffffffff
bootmem::__reserve nid=0 start=80b1b end=80b1c flags=1
OMAP4430 ES1.0
SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
bootmem::alloc_bootmem_core nid=0 size=2000000 [8192 pages] align=1000 goal=0 limit=0
bootmem::__reserve nid=0 start=80b1c end=82b1c flags=1
Reserving 33554432 bytes SDRAM for VRAM
bootmem::alloc_bootmem_core nid=0 size=1000 [1 pages] align=1000 goal=0 limit=ffffffff
bootmem::__reserve nid=0 start=82b1c end=82b1d flags=1
bootmem::alloc_bootmem_core nid=0 size=1c [1 pages] align=20 goal=0 limit=ffffffff
bootmem::__reserve nid=0 start=82b1d end=82b1e flags=1
bootmem::alloc_bootmem_core nid=0 size=72 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b1e end=82b1e flags=1
bootmem::alloc_bootmem_core nid=0 size=72 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b1e end=82b1e flags=1
bootmem::alloc_bootmem_core nid=0 size=1000 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b1e end=82b1f flags=1
bootmem::alloc_bootmem_core nid=0 size=1000 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b1f end=82b20 flags=1
bootmem::alloc_bootmem_core nid=0 size=20000 [32 pages] align=1000 goal=0 limit=0
bootmem::__reserve nid=0 start=82b20 end=82b40 flags=1
bootmem::mark_bootmem_node nid=0 start=82b28 end=82b30 reserve=0 flags=0
bootmem::__free nid=0 start=82b28 end=82b30
bootmem::mark_bootmem_node nid=0 start=82b38 end=82b40 reserve=0 flags=0
bootmem::__free nid=0 start=82b38 end=82b40
PERCPU: Embedded 8 pages/cpu @c2b20000 s9088 r8192 d15488 u65536
bootmem::alloc_bootmem_core nid=0 size=4 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b28 end=82b29 flags=1
bootmem::alloc_bootmem_core nid=0 size=4 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b29 flags=1
bootmem::alloc_bootmem_core nid=0 size=8 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b29 flags=1
bootmem::alloc_bootmem_core nid=0 size=8 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b29 flags=1
pcpu-alloc: s9088 r8192 d15488 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 
bootmem::alloc_bootmem_core nid=0 size=80 [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b29 flags=1
bootmem::alloc_bootmem_core nid=0 size=2c [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b29 flags=1
bootmem::alloc_bootmem_core nid=0 size=2c [1 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b29 flags=1
bootmem::mark_bootmem_node nid=0 start=82b1e end=82b1e reserve=0 flags=0
bootmem::__free nid=0 start=82b1e end=82b1e
bootmem::mark_bootmem_node nid=0 start=82b1f end=82b1f reserve=0 flags=0
bootmem::__free nid=0 start=82b1f end=82b1f
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 117602
Kernel command line: ro vram=32M mem=463M root=UUID=b09b4147-6e75-4d30-a6e5-df2694593027 fixrtc console=ttyO2,115200n8 bootmem_debug=1
bootmem::alloc_bootmem_core nid=0 size=2000 [2 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b29 end=82b2b flags=1
PID hash table entries: 2048 (order: 1, 8192 bytes)
bootmem::alloc_bootmem_core nid=0 size=40000 [64 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b38 end=82b78 flags=1
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
bootmem::alloc_bootmem_core nid=0 size=20000 [32 pages] align=20 goal=0 limit=0
bootmem::__reserve nid=0 start=82b78 end=82b98 flags=1
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
bootmem::free_all_bootmem_core nid=0 start=80000 end=9cf00 aligned=1
BUG: Bad page state in process swapper  pfn:94d23
page:c0a11460 count:0 mapcount:-897 mapping:(null) index:0x0
page flags: 0x0()
[<c00445b4>] (unwind_backtrace+0x0/0xf0) from [<c00ccde8>] (bad_page+0xc4/0xf0)
[<c00ccde8>] (bad_page+0xc4/0xf0) from [<c00cdf80>] (__free_pages_ok+0xf0/0x1ec)
[<c00cdf80>] (__free_pages_ok+0xf0/0x1ec) from [<c0016420>] (free_all_bootmem_core+0xf8/0x214)
[<c0016420>] (free_all_bootmem_core+0xf8/0x214) from [<c000cbcc>] (mem_init+0xec/0x3cc)
[<c000cbcc>] (mem_init+0xec/0x3cc) from [<c0008a0c>] (start_kernel+0x148/0x300)
[<c0008a0c>] (start_kernel+0x148/0x300) from [<80008080>] (0x80008080)
Disabling lock debugging due to kernel taint
bootmem::free_all_bootmem_core nid=0 released=1a375
---

Obviously, it dumps stack here is because page's mapcount=-897 which is supposed to 0.