The various oops that you've observed are all consistent with the
consequences of a page unlocking early: sometimes the scsi driver has
its buffers taken away, and sometimes shrink_mmap is walking a buffer
list when it disappears.
The influence of the stack-not-exec patch might be to change the value
of an uninitialized variable on the stack.
I just had an idea while typing this -- a while back I did a patch for
fs/exec.c that cleaned up stack trash that was being passed to the
read-ahead routines. That patch isn't in 2.0.xx, so I wonder if it's
possible that bogus read-ahead parameters are somehow affecting your
scsi driver? It could affect the pattern of read-ahead ... kind of a
long shot, but I don't have an other ideas.
Regards,
Bill