I've attached a preliminary patch that may help -- it cleanly
initializes the semaphore, and then acquires the current mmap_sem
before calling dup_mmap(). This isn't the best way to do things,
but if it help we're probably on the right track.
Another thing I noticed that looks possibly dangerous -- if the
memory map includes a mmapped file, the new mm gets added to the
inode's shared list. The mm is not yet fully constructed, but is
it possible that the new task could be prematurely awakened via the
inode shared list? Maybe somebody else here has looked into that
...
For reasons I've told you and Linus in another mail, vmscan.c page
freeing code needs to grab this semaphore as well.
Later,
David "Sparc" Miller
davem@caip.rutgers.edu