Ok, this crash _looks_ like the internal kernel buffer cache data structures
got corrupted, and when the linked list of hash structures gets corrupted
you'll see ugly things when some process tries to look up a page. The problem
is that it's not the access itself that is the problem, the corruption
happened earlier.
I'm rather inclined to blame the ISDN code: I don't consider that really
stable. I should probably have put the ISDN question as a experimental
option, because it was added so late in the 1.3.x tree..
> Using `/usr/src/linux/System.map' to map addresses to symbols.
>
> >>EIP: 1229f4 <get_hash_table+30/b4>
> Trace: 124005 <brw_page+129/350>
> Trace: 155849 <ext2_bmap+d9/24c>
> Trace: 12443b <generic_readpage+7b/88>
> Trace: 11b58f <filemap_nopage+117/2ac>
> Trace: 11b699 <filemap_nopage+221/2ac>
> Trace: 118c30 <do_no_page+104/344>
> Trace: 10fbab <do_page_fault+13f/29c>
>
> Code: 1229f4 <get_hash_table+30/b4> cmpl %ebp,(%eax)
> Code: 1229f6 <get_hash_table+32/b4> jne 122a20 <get_hash_table+5c/b4>
> Code: 1229f8 <get_hash_table+34/b4> cmpw %bx,0x4(%eax)
> Code: 1229fc <get_hash_table+38/b4> jne 122a20 <get_hash_table+5c/b4>
This is the code in "find_buffer()" (which is a inline function, so
that's why it shows up in get_hash_table()) that just goes through the
linked list of buffer hashes and checks
if (tmp->b_blocknr == block && tmp->b_dev == dev)
...
where "tmp" is some corrupted pointer (I can't say what it looks like,
because you don't include the register information from the dump).
Linus