[Manfred Spraul <manfred@colorfullife.com>]

You are right, there is a race in pipelined_send, but slightly different 
than in your description:
pipelined_send is carefull not to read the msr pointer after 
wake_up_process, but it does rely on the contents of the msr structure 
after setting msr->r_msg.

I.e. the description is

       CPU 1                    CPU 2

	sys_msgrcv()
	(sleeps for messsage)

				sys_msgsnd()
				pipelined_send()
	(woken up by a signal)
	Notices that a message is there,
	accepts the message and exists.
	stack trashed, perhaps even task structure gone.
	                        wake_up_process(msr->r_tsk)
				*oops - msr is not valid anymore.

Is that possible? Do you apps use signals?

Your fix solves the problem, but I'd prefer to keep the current, lockless receive path - it avoids 50% of the spinlock operations.
I'll write a patch that adds the missing memory barriers and copies the fields before setting msr->r_msg.

--
	Manfred