loop in copy_user_generic_string

["Zdenek Kabelac" <zdenek.kabelac@gmail.com>]

Hello


I'm having weird problem and being a bit puzzled about where to look
for this bug.

I'm using T61 - C2D  2GB

So I'll describe symptoms:

When I run inside my 0.5G smp  qemu-kvm guest with Debian these two
loops in parallel:

'while : ; do dmsetup status  ; done'

and

'while : ; do cat /dev/zero >/dev/mapper/any_free_to_use_lvm_partition ; done'

after a while dmsetup start to loop in this place:

[  356.257323] dmsetup       R  running task        0  3385   2342
[  356.257323]  ffff81001c9fbc58 ffffffff812ee85e 0000000000000000
0000000000000001
[  356.257323]  0000000000070617 0000000000000001 ffff81001be94000
ffff81001f864000
[  356.257323]  ffff81001be94360 000000018100cddc ffff81001be94000
ffffffff812f13b1
[  356.257323] Call Trace:
[  356.257323]  [<ffffffff812ee85e>] ? thread_return+0x99/0x51b
[  356.257323]  [<ffffffff812f13b1>] ? trace_hardirqs_on_thunk+0x35/0x3a
[  356.257323]  [<ffffffff81065749>] ? trace_hardirqs_on+0x139/0x1a0
[  356.257323]  [<ffffffff812f13b1>] ? trace_hardirqs_on_thunk+0x35/0x3a
[  356.257323]  [<ffffffff8100cddc>] ? restore_args+0x0/0x30
[  356.257323]  [<ffffffff8117c017>] ? copy_user_generic_string+0x17/0x40
[  356.257323]  [<ffffffff8804c527>] ? :dm_mod:copy_params+0x87/0xb0
[  356.257323]  [<ffffffff81047d11>] ? __capable+0x11/0x30
[  356.257323]  [<ffffffff8804c6b9>] ? :dm_mod:ctl_ioctl+0x169/0x260
[  356.257323]  [<ffffffff8804c7dd>] ? :dm_mod:dm_compat_ctl_ioctl+0xd/0x20
[  356.257323]  [<ffffffff810f6c12>] ? compat_sys_ioctl+0x182/0x3d0
[  356.257323]  [<ffffffff810bbba0>] ? vfs_write+0x130/0x170
[  356.257323]  [<ffffffff812f13eb>] ? trace_hardirqs_off_thunk+0x35/0x37
[  356.257323]  [<ffffffff8102aec2>] ? sysenter_do_call+0x1b/0x70
[  356.257323]  [<ffffffff812f13b1>] ? trace_hardirqs_on_thunk+0x35/0x3a


I'm using preemptible kernel and the code will stay in the
copy_user_generic_string call forever eating 100%cpu - without
preemption the kernel gets dead.

With preemption when I run at this moment second dmsetup status in
paralllel the busy-looped dmsetup gets finished and while loop starts
to continue agains until next dmsetup busy-loop.

I've noticed that if I change inside  drivers/md/dm-ioctl.c
copy_params  the parameter tmp.data_size in the copy_from_user call to
just page size (4kB) - or when I replace vmalloc to kmalloc - the busy
loop will not happen.

So it seems to be related to page jump somehow

Anyway might have any idea - what is going on here ?

Thanks

Zdenek

Cc me please I'm not a litst member.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/