I happened to spot this kfree(of complete garbage) - it is on an
oh-we-raced-retry path which is obviously exceedingly rare, 


 fs/jbd/journal.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN fs/jbd/journal.c~journal_write_metadata_buffer-kfree-fix fs/jbd/journal.c
--- 25/fs/jbd/journal.c~journal_write_metadata_buffer-kfree-fix	2003-10-16 22:12:55.000000000 -0700
+++ 25-akpm/fs/jbd/journal.c	2003-10-16 22:58:18.000000000 -0700
@@ -342,7 +342,7 @@ repeat:
 		tmp = jbd_rep_kmalloc(bh_in->b_size, GFP_NOFS);
 		jbd_lock_bh_state(bh_in);
 		if (jh_in->b_frozen_data) {
-			kfree(new_page);
+			kfree(tmp);
 			goto repeat;
 		}
 

_