* Nicholas Mc Guire | 2014-02-10 16:37:59 [+0100]:

2a) premption induced race in __this_cpu_dec
 T1 dec:start
              T2 dec
 T1 dec:end

__this_cpu_dec 
 -> __this_cpu_sub 
   -> __this_cpu_add
     -> __this_cpu_add_#
       -> __this_cpu_generic_to_op
        -> __this_cpu_ptr += val


so we end up with the possibilities of
 T1 load
         T2 load
         T2 store
 T1 store
and the increment provided by T2 would be lost. The result of which
is that reaching the buffer_heads_over_limit threshold in recalc_bh_state 

I don't like this very much. __this_cpu_inc() is not atomic as you say
and without the locking that is provided by preempt_disable() it might
lose one store in inc or dec direction. This error will never be
corrected again. That code path looks very short unless you have 4096
CPUs.

Sebastian