I got an oops with 2.6.9-rc2 in free_blocks. 
If I find a reliable way to reproduce, I will let you know.
2.6.8.1 was running stable for some weeks on the same machine.

Of the functions within the call trace cache_reap seems to have the most 
invasive changes between 2.6.8.1 and 2.6.9-rc2, but I dont know if there is 
the problem. 

config is attached

cheers

Christian



 Unable to handle kernel paging request at virtual address 013bab07
  printing eip:
 c013e7ac
 *pde = 00000000
 Oops: 0000 [#1]
 PREEMPT
 Modules linked in: isofs usb_storage scsi_mod pcspkr floppy 8250_pnp 
ipt_state ipt_MASQUERADEiptable_nat ip_conntrack iptable_filter ip_tables 
vfat fat nls_iso8859_15 ntfs lp loop w83781d i2c_viapro i2c_dev i2c_sensor 
af_packet nls_cp437 joydev nls_iso8859_1 3c59x evdev usbhid parport_pc 
parport 8250 serial_core uhci_hcd usbcore
 CPU:    0
 EIP:    0060:[<c013e7ac>]    Not tainted VLI
 EFLAGS: 00010016   (2.6.9-rc2)
 EIP is at free_block+0x4c/0xe0
 eax: 0080cc00   ebx: 013bab03   ecx: 00660044   edx: c1000000
 esi: c178f7e0   edi: 00000000   ebp: eff09f04   esp: eff09ee8
 ds: 007b   es: 007b   ss: 0068
 Process events/0 (pid: 3, threadinfo=eff08000 task=eff90020)
 Stack: c178f7ec c178f7fc 08cccccd c17aa0d0 c17aa0d0 c17aa0c0 08cccccd 
eff09f1c
        c013ef42 c178f7e0 c178f4fc c178f7e0 eff08000 eff09f44 c013efe6 
c178f4fc
        eff08000 00000001 c178f850 00000292 c04fede0 eff08000 c04fede4 
eff09fc8
 Call Trace:
  [<c0105e5a>] show_stack+0x7a/0x90
  [<c0105fdd>] show_registers+0x14d/0x1b0
  [<c01061c4>] die+0xe4/0x170
  [<c0116635>] do_page_fault+0x225/0x5ac
  [<c0105a59>] error_code+0x2d/0x38
  [<c013ef42>] drain_array_locked+0x62/0x90
  [<c013efe6>] cache_reap+0x76/0x1b0
  [<c012a530>] worker_thread+0x180/0x240
  [<c012e1c5>] kthread+0x95/0xa0
  [<c0103291>] kernel_thread_helper+0x5/0x14
 Code: 8d 56 0c 89 45 e8 89 55 e4 8d b6 00 00 00 00 8b 45 f0 8b 15 10 ef 4f 
c0 8b 0c b8 8d 81 00 00 00 40 c1 e8 0c c1 e0 05 8b 5c 02 1c <8b> 53 04 8b 
03 89 50 04 89 02 c7 43 04 00 02 20 00 2b 4b 0c c7
  <3>Debug: sleeping function called from invalid context at 
include/linux/rwsem.h:43
 in_atomic():1, irqs_disabled():0
  [<c0105e87>] dump_stack+0x17/0x20
  [<c0118e34>] __might_sleep+0xb4/0xe0
  [<c011bfe3>] profile_task_exit+0x23/0x60
  [<c011da59>] do_exit+0x19/0x430
  [<c010624e>] die+0x16e/0x170
  [<c0116635>] do_page_fault+0x225/0x5ac
  [<c0105a59>] error_code+0x2d/0x38
  [<c013ef42>] drain_array_locked+0x62/0x90
  [<c013efe6>] cache_reap+0x76/0x1b0
  [<c012a530>] worker_thread+0x180/0x240
  [<c012e1c5>] kthread+0x95/0xa0
  [<c0103291>] kernel_thread_helper+0x5/0x14
 note: events/0[3] exited with preempt_count 1