Looks like an important bug -- we better find it!
> Something bad is going on.... Does anybody have any ideas?
I'll toss out an idea -- in copy_mm() for the non-cloning case, the new
mm is initialized by copying current->mm. If by some chance the
semaphore in current->mm was active, this would give the new mm
structure a bogus semaphore. If current was itself cloned from another
task, it's possible that other task might be using the mm semaphore,
thus setting the conditions for the above to happen.
If this is the case, at least it would be easy to fix.
Will study the code tomorrow ... any further clues would be welcome.