That doesn't help because we call reset_page_owner() in the free page path.
We could turn on tracing because we call trace_mm_page_free() in this
path. That requires the reporter to be able to reproduce the problem,
and it's not clear to me whether this is a "happened once" or "every
time I do this, it happens" problem.
It happened on 3 of the boots with that kernel. 4th time box either spontaneously rebooted when X started, or watchdog restarted box shortly after starting X server.
So I believe I should be able to reproduce it with additional patches or extra flags enabled.
Petr