Crash from balloon_init in latest stable-2.6.32.x

[M A Young]

Are there any ideas about this crash

last_pfn = 0x42fe0c max_arch_pfn = 0x400000000
BUG: unable to handle kernel paging request at ffffea000e700030
IP: [<ffffffff812352e7>] __list_add+0x6c/0x81
PGD 1a37067 PUD 1a38067 PMD 226f8f067 PTE 0
Oops: 0002 [#1] SMP
last sysfs file:
CPU 5
Modules linked in:
Pid: 1, comm: swapper Tainted: G        W 
2.6.32.25-171.rc1.xendom0.fc12.x86_64 #1 H8DGT
RIP: e030:[<ffffffff812352e7>]  [<ffffffff812352e7>] __list_add+0x6c/0x81
RSP: e02b:ffff8803e3491e50  EFLAGS: 00010246
RAX: 000000000e700000 RBX: ffffea000e6ffff0 RCX: 0000000000000a2d
RDX: ffffea000e6ffff0 RSI: ffffffff816dc030 RDI: ffffea000e700028
RBP: ffff8803e3491e70 R08: ffffea000e6ffff0 R09: 0000000000000001
R10: 0000000000000008 R11: 00000000e3491d78 R12: ffffffff816dc030
R13: ffffea000e700028 R14: 0000000000000100 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8802270e4000(0000) 
knlGS:0000000000000000
CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffea000e700030 CR3: 0000000001001000 CR4: 0000000000000660
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 1, threadinfo ffff8803e3490000, task 
ffff8802170b8000)
Stack:
  0000000000000100 0000000000420000 ffffea0000000000 000000000042fe0c
<0> ffff8803e3491ea0 ffffffff8182ac21 ffffffff8182aa4e ffffffff8182aa4e
<0> 0000000000000000 00000000294d99f2 ffff8803e3491ed0 ffffffff8100a069
Call Trace:
  [<ffffffff8182ac21>] balloon_init+0x1d3/0x213
  [<ffffffff8182aa4e>] ? balloon_init+0x0/0x213
  [<ffffffff8182aa4e>] ? balloon_init+0x0/0x213
  [<ffffffff8100a069>] do_one_initcall+0x5e/0x159
  [<ffffffff817fa75f>] kernel_init+0x1fd/0x257
  [<ffffffff81013d6a>] child_rip+0xa/0x20
  [<ffffffff81012f51>] ? int_ret_from_sys_call+0x7/0x1b
  [<ffffffff810136dd>] ? retint_restore_args+0x5/0x6
  [<ffffffff81013d60>] ? child_rip+0x0/0x20
Code: 04 24 49 39 d8 74 20 4d 89 e1 48 89 d9 48 c7 c2 65 10 60 81 be 1e 00 
00 00 48 c7 c7 cd 0f 60 81 31 c0 e8 67 23 e2 ff 4c 89 6b 08 <4d> 89 65 08 
49 89 5d 00 4d 89 2c 24 5b 5b 41 5c 41 5d c9 c3 90
RIP  [<ffffffff812352e7>] __list_add+0x6c/0x81
  RSP <ffff8803e3491e50>
CR2: ffffea000e700030
---[ end trace a7919e7f17c0a726 ]---

The full serial console output is at the provided link. I did some tracing 
myself and the problem seems to be happening at the list_add call in 
__balloon_append called from balloon_init in drivers/xen/ballon.c. This is 
with a kernel I built today (at 
http://koji.fedoraproject.org/koji/taskinfo?taskID=2550132 ) with the 
latest stable-2.6.32.x , the 170.1 kernel was built on Thursday (21st Oct) 
and 170 on 6th October and would have used stable-2.6.32.x at those dates.

 	Michael Young

---------- Forwarded message ----------
Date: Sat, 23 Oct 2010 14:06:56 -0700
From: fcxen user <fcxen(a)itsbeen.sent.com&gt;
To: M A Young <m.a.young(a)durham.ac.uk&gt;, xen(a)lists.fedoraproject.org
Subject: Re: [Fedora-xen] another xen kernel

170, 170.1, 171 crashed the same

using:
title Xen
         root (hd0,0)
         kernel /xen.gz loglvl=all guest_loglvl=all sync_console console_to_ring 
com2=115200,8n1 console=com2,vga lapic=debug apic_verbosity=debug apic=debug 
iommu=off
         module /vmlinuz-2.6.32.25-171.rc1.xendom0.fc12.x86_64 ro 
root=UUID=84e6a109-84c5-4288-80de-ea368a224a3a 
rd_MD_UUID=c557e3e8:d9ef50b8:b5e9861f:26975533 
rd_MD_UUID=5825fd8c:77ea8324:ae0c8804:8a0c2
487 rd_NO_LUKS rd_NO_LVM rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 
KEYTABLE=us console=hvc0 earlyprintk=xen nomodeset initcall_debug debug 
loglevel=10
         module /initramfs-2.6.32.25-171.rc1.xendom0.fc12.x86_64.img


Latest output is:
http://pastie.org/1243649