Most recent kernel where this bug did not occur: Not try yet

Distribution: Linux 2.6.15 from www.kernel.org

Hardware Environment: ARM v4t with SATA interface and Gigabit MAC

Software Environment: samba-3.0.25a with sendfile enabled

Problem Description:
     Got kernel fault after do copy/compile from samba for a whil

Steps to reproduce:
      Coonnect 8 PCs with the board and do copy/compare files, after a lot of time system got crash.

Unable to handle kernel paging request at virtual address 40783384
pgd = c2980000
[40783384] *pgd=00d81031, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1]
Modules linked in: g_file_storage
CPU: 0
PC is at 0x40322aec
LR is at 0x403229bc
pc : [<40322aec>]    lr : [<403229bc>]    Not tainted
sp : be8301cc  ip : 003395ac  fp : 00216050
r10: 003392dc  r9 : fee1dead  r8 : 00209384
r7 : be83028c  r6 : 00000018  r5 : 40783384  r4 : be83028c
r3 : 00000006  r2 : 00000006  r1 : 40783384  r0 : be83028c
Flags: Nzcv  IRQs on  FIQs on  Mode USER_32  Segment user
Control: 397F  Table: 02980000  DAC: 00000015
Process smbd (pid: 946, stack limit = 0xc232a194)
Stack: (0xbe8301cc to 0xc232c000)
01c0:                            be83028c 00398de8 00000018 be83028c 

After I trace into kernel and found it is caused by
./linux/arch/arm/mm/fault.c

int do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
{
        if(in_interrupt() || !mm)
        {
                goto no_context;
        }       
}
and check the preempt_count(), it is 256, means software interrupt is on

Any advice is welcome.