Hello,

this is reproducible for me problem:
This wilson mmap test (attached) causes the kernel BUG at mm/mmap.c:1793 
immediately after running.

kernel :  2.6.7-mm4 (no extra patches)
test : wison-mmap-test -s 1000
tested filesystem :  ext2
RAM : 256Mb

machine :
# car /proc/cpuinfo
processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 6
model           : 6
model name      : AMD Athlon(tm) MP Processor 1700+
stepping        : 2
cpu MHz         : 1460.204
cache size      : 256 KB
fdiv_bug        : no
hlt_bug         : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge 
mca cmov pat pse36 mmx fxsr sse syscall mp mmxext 3dnowext 3dnow
bogomips        : 2883.58

processor       : 1
vendor_id       : AuthenticAMD
cpu family      : 6
model           : 6
model name      : AMD Athlon(tm) Processor
stepping        : 2
cpu MHz         : 1460.204
cache size      : 256 KB
fdiv_bug        : no
hlt_bug         : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge 
mca cmov pat pse36 mmx fxsr sse syscall mp mmxext 3dnowext 3dnow
bogomips        : 2916.35


------------[ cut here ]------------
kernel BUG at mm/mmap.c:1793!
invalid operand: 0000 [#1]
SMP

Program received signal SIGTRAP, Trace/breakpoint trap.
0xc01441af in exit_mmap (mm=0xcf90a040) at tlb.h:78
78                      tlb->nr = 0;
(gdb)

(gdb) bt
#0  0xc01441af in exit_mmap (mm=0xcf90a040) at tlb.h:78
#1  0xc011c137 in mmput (mm=0xcf90a040) at kernel/fork.c:464
#2  0xc011ff95 in do_exit (code=11) at kernel/exit.c:516
#3  0xc012024a in do_group_exit (exit_code=11) at kernel/exit.c:886
#4  0xc0127f3f in get_signal_to_deliver (info=0xccd4df24, regs=0xccd4dfc4,
    cookie=0xc12067c8) at kernel/signal.c:1871
#5  0xc01059eb in do_signal (regs=0xccd4dfc4, oldset=0xcf53ec04)
    at arch/i386/kernel/signal.c:572
#6  0xc0105acb in do_notify_resume (regs=0xccd4dfc4, oldset=0xffffffd4,
    thread_info_flags=3240126408) at arch/i386/kernel/signal.c:619
#7  0xc0105cbe in work_notifysig () at arch/i386/kernel/entry.S:350
#8  0x1ffccfd8 in ?? ()
#9  0x00000400 in ?? ()
(gdb)

(gdb) c
Continuing.
CPU:    0
EIP:    0060:[<c01441af>]    Not tainted VLI
EFLAGS: 00010202   (2.6.7-mm4)
EIP is at exit_mmap+0x13f/0x150
eax: 00000001   ebx: c1204040   ecx: c12067c8   edx: ffffffd4
esi: cf90a040   edi: cf53e6c0   ebp: ccd4dea0   esp: ccd4de80
ds: 007b   es: 007b   ss: 0068
Process wilson-mmap-tes (pid: 968, threadinfo=ccd4c000 task=cf53e6c0)
Stack: 00000000 ffffffff ccd4de94 00000000 c1204040 0000002c cf90a040 
cf90a06c
       ccd4deac c011c137 cf90a040 ccd4ded0 c011ff95 00000000 cf53e6c0 
0000000a
       00000000 cf652b00 ccd4c000 0000000b ccd4deec c012024a 0000000b 
cf53ec04
Call Trace:
 [<c0106aa6>] show_stack+0xa6/0xb0
 [<c0106c1d>] show_registers+0x14d/0x1c0
 [<c0106dca>] die+0xaa/0x130
 [<c01071ec>] do_invalid_op+0x9c/0xa0
 [<c01066dd>] error_code+0x2d/0x38
 [<c011c137>] mmput+0x57/0x90
 [<c011ff95>] do_exit+0x155/0x330
 [<c012024a>] do_group_exit+0x3a/0xc0
 [<c0127f3f>] get_signal_to_deliver+0x26f/0x370
 [<c01059eb>] do_signal+0x5b/0x100
 [<c0105acb>] do_notify_resume+0x3b/0x3d
 [<c0105cbe>] work_notifysig+0x13/0x15
Code: 5b 5e c9 c3 8b 03 c7 43 08 00 00 00 00 e8 fa fa fc ff 8b 53 04 83 
fa ff 74 a2 8d 43 14 e8 4a 67 00 00 c7 43 04 00 00 00 00 eb 91 <0f> 0b 
01 07 ec c3 41 c0 e9 59 ff ff ff 8d 74 26 00 55 89 e5 56


Thanks,
Lena.