Re: loop in copy_user_generic_string

[Avi Kivity <avi@qumranet.com>]

Zdenek Kabelac wrote:
> Hello
>
>
> I'm having weird problem and being a bit puzzled about where to look
> for this bug.
>
> I'm using T61 - C2D  2GB
>
> So I'll describe symptoms:
>
> When I run inside my 0.5G smp  qemu-kvm guest with Debian these two
> loops in parallel:
>
> 'while : ; do dmsetup status  ; done'
>
> and
>
> 'while : ; do cat /dev/zero >/dev/mapper/any_free_to_use_lvm_partition ; done'
>
> after a while dmsetup start to loop in this place:
>
> [  356.257323]  [<ffffffff8117c017>] ? copy_user_generic_string+0x17/0x40
>
>
> I'm using preemptible kernel and the code will stay in the
> copy_user_generic_string call forever eating 100%cpu - without
> preemption the kernel gets dead.
>
> With preemption when I run at this moment second dmsetup status in
> paralllel the busy-looped dmsetup gets finished and while loop starts
> to continue agains until next dmsetup busy-loop.
>
> I've noticed that if I change inside  drivers/md/dm-ioctl.c
> copy_params  the parameter tmp.data_size in the copy_from_user call to
> just page size (4kB) - or when I replace vmalloc to kmalloc - the busy
> loop will not happen.
>
> So it seems to be related to page jump somehow
>
> Anyway might have any idea - what is going on here ?
>   

Most likely movs emulation is broken for long counts.  Please post a 
disassembly of copy_user_generic_string to make sure we're looking at 
the same code.

-- 
error compiling committee.c: too many arguments to function


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/