I first ran into this while testing a new build of gparted under Ubuntu Natty daily. I have since been able to replicate it under Maverick while running a kernel built from Linus's tree. Sometimes it happens when removing a partition within gparted, sometimes it happens when I just run dmraid -an. The call stack appears to be:
My guess is that something else is calling dput() once too many times and when you go to remove the device, it is freed early and triggers the BUG().
I'm starting to bisect now.
This is definitely a regression since 2.6.37.
(As well as bisecting, please attach the oops.)
The following patch (to fix bug 29202) may fix this bug too:
Yep, that fixed it.
*** This bug has been marked as a duplicate of bug 29202 ***