Bug 99167

here is a program to cause the BUG check:

#include <stdio.h>
#include <errno.h>
#include <assert.h>
#include <stdlib.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/shm.h>

#include <libaio.h>



io_context_t    io_ctx;
#define BAD_CTX ((io_context_t)-1)

void aio_setup(int n)
{
        int res = io_queue_init(n, &io_ctx);
        if (res != 0) {
                printf("io_queue_setup(%d) returned %d (%s)\n",
                        n, res, strerror(-res));
                exit(3);
        }
}

int attempt_io_submit(io_context_t ctx, long nr, struct iocb *ios[], int expect)
{
        int res;

        printf("expect %3d: io_submit(%10p, %3ld, %10p) = ", expect, ctx, nr, ios);
        fflush(stdout);
        res = io_submit(ctx, nr, ios);
        printf("%3d [%s]%s\n", res, (res <= 0) ? strerror(-res) : "",
                (res != expect) ? " -- FAILED" : "");
        if (res != expect)
                return 1;

        return 0;
}

int sync_submit(struct iocb *iocb)
{
        struct io_event event;
        struct iocb *iocbs[] = { iocb };
        int res;

        /* 30 second timeout should be enough */
        struct timespec ts;
        ts.tv_sec = 30;
        ts.tv_nsec = 0;

        res = io_submit(io_ctx, 1, iocbs);
        if (res != 1) {
                printf("sync_submit: io_submit res=%d [%s]\n", res, strerror(-res));
                return res;
        }

        res = io_getevents(io_ctx, 0, 1, &event, &ts);
        if (res != 1) {
                printf("sync_submit: io_getevents res=%d [%s]\n", res,
strerror(-res));
                return res;
        }
        return event.res;
}

#define SETUP   aio_setup(1024)


#define READ            'r'
#define WRITE           'w'
#define READ_SILENT     'R'
#define WRITE_SILENT    'W'
int attempt_rw(int fd, void *buf, int count, long long pos, int rw, int expect)
{
        struct iocb iocb;
        int res;
        int silent = 0;

        switch(rw) {
        case READ_SILENT:
                silent = 1;
        case READ:
                io_prep_pread (&iocb, fd, buf, count, pos);
                break;
        case WRITE_SILENT:
                silent = 1;
        case WRITE:
                io_prep_pwrite(&iocb, fd, buf, count, pos);
                break;
        }

        if (!silent) {
                printf("expect %5d: (%c), res = ", expect, rw);
                fflush(stdout);
        }
        res = sync_submit(&iocb);
        if (!silent || res != expect) {
                if (silent)
                        printf("expect %5d: (%c), res = ", expect, rw);
                printf("%5d [%s]%s\n", res,
                        (res <= 0) ? strerror(-res) : "Success",
                        (res != expect) ? " -- FAILED" : "");
        }

        if (res != expect)
                return 1;

        return 0;
}

#define LPAGE_SIZE      (2UL*1024UL*1024UL)


int main(void)
{
#define SIZE    512
        char buf2[SIZE];
        char *buf;
        int rwfd;
        int     status = 0;
        int shmid;
        int res, i;

        SETUP;
        rwfd = open("/tmp/foo", O_CREAT | O_RDWR);              assert(rwfd != -1);
        res = ftruncate(rwfd, 512);                     assert(res == 0);

        if((shmid = shmget(4, LPAGE_SIZE, SHM_HUGETLB|IPC_CREAT|SHM_R|SHM_W)) < 0) {
                perror("Failure:");
                exit(1);
        }
        printf("shmid: 0x%x\n", shmid);
        buf = shmat(shmid, NULL, SHM_RND) ;
        printf("attached at: %p\n", buf);
        if (errno != 0) {
                perror("Shared Memory Attach Failure:");
                exit(2);
        }

        for(i=0;i<LPAGE_SIZE/SIZE;i++) {
                status |= attempt_rw(rwfd, &buf[i*SIZE], SIZE, 0, READ, SIZE);
        }

        close(rwfd);

        return status;

}

the cause of the bug was a hugetlb-unaware line in mm_map_user_kvec(), sent the
fix. It fixes your testcase. Please retest with the next build.

For anyone else that happens to come across this bug, need to actually allocate
hugepages before attempting to use them:

echo "20" > proc/sys/vm/hugetlb_pool

Anyway, the fix is confirmed with 2.4.21-1.1931.2.349.2.2.ent