I also got this right before this gpf..:
task not on run-queue
Using `/System.map' to map addresses to symbols.
>>EIP: 11045a <add_timer+16/34>
Trace: 10ffeb <schedule+237/294>
Trace: 10fd3c <process_timeout>
Trace: 12b548 <do_select+274/2d0>
Trace: 12b7a7 <sys_select+177/29c>
Trace: 10f327 <old_select+3f/50>
Trace: 10a369 <system_call+59/a0>
Code: 11045a <add_timer+16/34> cmpl %eax,0x8(%edx)
Code: 11045d <add_timer+19/34> jb fffffffe <_EIP+fffffffe>
Code: 11045f <add_timer+1b/34> movl %edx,(%ecx)
Code: 110461 <add_timer+1d/34> movl 0x4(%edx),%eax
Code: 110464 <add_timer+20/34> movl %eax,0x4(%ecx)
Code: 110467 <add_timer+23/34> movl %ecx,0x4(%edx)
Code: 11046a <add_timer+26/34> movl 0x4(%ecx),%eax
Code: 11046d <add_timer+29/34> movl %eax,(%eax)
Code: 11046f <add_timer+2b/34> nop
Code: 110470 <add_timer+2c/34> nop
Code: 110471 <add_timer+2d/34> nop