kernel BUG at /usr/src/linux-source-2.6.38/drivers/staging/zram/xvmalloc.c:433!

What steps will reproduce the problem?
1. Running standard natty image on Amazon EC2 xen virtual machine 
(linux-2.6.38-11-virtual)
2. Compiling zram module and creating one zram swap device myself (the module 
does not exist in standard)
3. Filling up all RAM and zram swap 

What version of the product are you using? On what operating system?

zram module source as of package linux-source-2.6.38-11 on Ubuntu 11.04 natty.

zram works perfectly until programs take full memory. Then I get:

[  388.892616] ------------[ cut here ]------------
[  388.892634] kernel BUG at 
/usr/src/linux-source-2.6.38/drivers/staging/zram/xvmalloc.c:433!
[  388.892644] invalid opcode: 0000 [#1] SMP 
[  388.892651] last sysfs file: 
/sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
[  388.892661] Modules linked in: zram(C) binfmt_misc ip6table_filter 
act_police cls_flow cls_fw cls_u32 sch_tbf sch_prio sch_htb sch_hfsc 
sch_ingress sch_sfq xt_time xt_connlimit xt_realm iptable_raw xt_comment 
xt_recent xt_policy ipt_ULOG ipt_REJECT ipt_REDIRECT ipt_NETMAP ipt_MASQUERADE 
ipt_ECN ipt_ecn ipt_CLUSTERIP ipt_ah ipt_addrtype nf_nat_tftp nf_nat_snmp_basic 
nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp 
nf_nat_amanda ts_kmp nf_conntrack_amanda nf_conntrack_sane nf_conntrack_tftp 
nf_conntrack_sip nf_conntrack_proto_sctp nf_conntrack_pptp 
nf_conntrack_proto_gre nf_conntrack_netlink nf_conntrack_netbios_ns 
nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp xt_TPROXY nf_tproxy_core 
ip6_tables nf_defrag_ipv6 xt_tcpmss xt_pkttype xt_physdev xt_owner xt_NFQUEUE 
xt_NFLOG nfnetlink_log xt_multiport xt_mark xt_mac xt_limit xt_length 
xt_iprange xt_helper xt_hashlimit xt_DSCP xt_dscp xt_dccp xt_conntrack 
xt_connmark xt_CLASSIFY ipt_LOG xt_tcpudp xt_state iptable_nat nf_nat 
nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack iptable_mangle nfnetlink 
iptable_filter ip_tables x_tables parport_pc ppdev lp parport acpiphp
[  388.892854] 
[  388.892859] Pid: 2684, comm: sshd Tainted: G         C  2.6.38-11-virtual 
#48-Ubuntu  
[  388.892873] EIP: 0061:[<edf2c8e8>] EFLAGS: 00010202 CPU: 0
[  388.892883] EIP is at xv_free+0x1d8/0x1e0 [zram]
[  388.892890] EAX: f57ba000 EBX: f57bab7c ECX: 80000000 EDX: 00002267
[  388.892898] ESI: 00000b7c EDI: f57ba000 EBP: c16d5d88 ESP: c16d5d30
[  388.892905]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0069
[  388.892913] Process sshd (pid: 2684, ti=c16d4000 task=c1573f20 
task.ti=c16d4000)
[  388.892922] Stack:
[  388.892927]  c16d5d44 c0105755 80000000 61c0a063 61c0a063 c16d5d5c c01057d0 
c16d5d64
[  388.892943]  c0106a04 00000000 f57ba000 ed28d140 ed28d140 c137c000 c137c044 
00000004
[  388.892959]  c010657c f57ba000 c16d5d88 c17d50c0 ed28d140 00000b80 c16d5db8 
edf2b0ab
[  388.892976] Call Trace:
[  388.892987]  [<c0105755>] ? pte_pfn_to_mfn+0x85/0xa0
[  388.892995]  [<c01057d0>] ? xen_make_pte+0x40/0xe0
[  388.893003]  [<c0106a04>] ? xen_set_pte+0x24/0x60
[  388.893011]  [<c010657c>] ? xen_flush_tlb_single+0x6c/0x80
[  388.893020]  [<edf2b0ab>] zram_free_page+0x6b/0x110 [zram]
[  388.893031]  [<c022e977>] ? swap_cgroup_record+0x67/0x80
[  388.893040]  [<edf2b16c>] zram_slot_free_notify+0x1c/0x30 [zram]
[  388.893048]  [<c022e2f7>] ? mem_cgroup_uncharge_swap+0x27/0x70
[  388.893058]  [<c0218cd3>] swap_entry_free+0xf3/0x170
[  388.893067]  [<c0637000>] ? _raw_spin_trylock_bh+0x20/0x30
[  388.893075]  [<edf2b150>] ? zram_slot_free_notify+0x0/0x30 [zram]
[  388.893083]  [<c021a5ab>] swapcache_free+0x2b/0x60
[  388.893091]  [<c02181d2>] delete_from_swap_cache+0x42/0x60
[  388.893098]  [<c021aebf>] free_swap_and_cache+0xbf/0x100
[  388.893106]  [<c0209d73>] zap_pte_range+0x2d3/0x410
[  388.893114]  [<c0105755>] ? pte_pfn_to_mfn+0x85/0xa0
[  388.893122]  [<c0209fc5>] unmap_page_range+0x115/0x1b0
[  388.893130]  [<c020a627>] unmap_vmas+0x137/0x280
[  388.893137]  [<c02109fe>] exit_mmap+0x9e/0x160
[  388.893147]  [<c0156c1b>] mmput+0x3b/0xd0
[  388.893154]  [<c015cd0e>] exit_mm+0xfe/0x130
[  388.893161]  [<c015ce59>] do_exit+0x119/0x350
[  388.893168]  [<c015d1ee>] do_group_exit+0x3e/0xa0
[  388.893176]  [<c015d268>] sys_exit_group+0x18/0x20
[  388.893184]  [<c0637464>] syscall_call+0x7/0xb
[  388.893190] Code: 21 d2 8b 45 e0 e8 f9 c7 1d d2 90 8b 45 d8 31 d2 e8 9e 69 
2c d2 8b 55 dc 83 82 28 10 00 00 ff 83 92 2c 10 00 00 ff e9 48 ff ff ff <0f> 0b 
8d b6 00 00 00 00 55 89 e5 3e 8d 74 26 00 0f b7 40 fc 5d 
[  388.893273] EIP: [<edf2c8e8>] xv_free+0x1d8/0x1e0 [zram] SS:ESP 0069:c16d5d30
[  388.893287] ---[ end trace e243f9a6eaf5b916 ]---
[  388.893294] Fixing recursive fault but reboot is needed!
[  388.893301] BUG: scheduling while atomic: sshd/2684/0x00000002
[  388.893308] Modules linked in: zram(C) binfmt_misc ip6table_filter 
act_police cls_flow cls_fw cls_u32 sch_tbf sch_prio sch_htb sch_hfsc 
sch_ingress sch_sfq xt_time xt_connlimit xt_realm iptable_raw xt_comment 
xt_recent xt_policy ipt_ULOG ipt_REJECT ipt_REDIRECT ipt_NETMAP ipt_MASQUERADE 
ipt_ECN ipt_ecn ipt_CLUSTERIP ipt_ah ipt_addrtype nf_nat_tftp nf_nat_snmp_basic 
nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp 
nf_nat_amanda ts_kmp nf_conntrack_amanda nf_conntrack_sane nf_conntrack_tftp 
nf_conntrack_sip nf_conntrack_proto_sctp nf_conntrack_pptp 
nf_conntrack_proto_gre nf_conntrack_netlink nf_conntrack_netbios_ns 
nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp xt_TPROXY nf_tproxy_core 
ip6_tables nf_defrag_ipv6 xt_tcpmss xt_pkttype xt_physdev xt_owner xt_NFQUEUE 
xt_NFLOG nfnetlink_log xt_multiport xt_mark xt_mac xt_limit xt_length 
xt_iprange xt_helper xt_hashlimit xt_DSCP xt_dscp xt_dccp xt_conntrack 
xt_connmark xt_CLASSIFY ipt_LOG xt_tcpudp xt_state iptable_nat nf_nat 
nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack iptable_mangle nfnetlink 
iptable_filter ip_tables x_tables parport_pc ppdev lp parport acpiphp
[  388.893498] Pid: 2684, comm: sshd Tainted: G      D  C  2.6.38-11-virtual 
#48-Ubuntu
[  388.893507] Call Trace:
[  388.893514]  [<c0147dd2>] ? __schedule_bug+0x62/0x70
[  388.893524]  [<c0635233>] ? schedule+0x713/0x740
[  388.893532]  [<c015975b>] ? vprintk+0x18b/0x480
[  388.893540]  [<c015d05b>] ? do_exit+0x31b/0x350
[  388.893548]  [<c06349f9>] ? printk+0x30/0x37
[  388.893556]  [<c06386a6>] ? oops_end+0x96/0xd0
[  388.893565]  [<c010df24>] ? die+0x54/0x80
[  388.893571]  [<c0637db6>] ? do_trap+0x96/0xd0
[  388.893578]  [<c010b6f0>] ? do_invalid_op+0x0/0xa0
[  388.893585]  [<c010b77b>] ? do_invalid_op+0x8b/0xa0
[  388.893594]  [<edf2c8e8>] ? xv_free+0x1d8/0x1e0 [zram]
[  388.893602]  [<c010721e>] ? __raw_callee_save_xen_restore_fl+0x6/0x8
[  388.893610]  [<c0104bb0>] ? xen_mc_flush+0x90/0x1b0
[  388.893618]  [<c010592d>] ? arbitrary_virt_to_machine+0xbd/0xe0
[  388.893627]  [<c010721e>] ? __raw_callee_save_xen_restore_fl+0x6/0x8
[  388.893636]  [<c0104bb0>] ? xen_mc_flush+0x90/0x1b0
[  388.893643]  [<c0105755>] ? pte_pfn_to_mfn+0x85/0xa0
[  388.893651]  [<c0637b4f>] ? error_code+0x67/0x6c
[  388.893659]  [<edf2c8e8>] ? xv_free+0x1d8/0x1e0 [zram]
[  388.893667]  [<c0105755>] ? pte_pfn_to_mfn+0x85/0xa0
[  388.893675]  [<c01057d0>] ? xen_make_pte+0x40/0xe0
[  388.893682]  [<c0106a04>] ? xen_set_pte+0x24/0x60
[  388.893690]  [<c010657c>] ? xen_flush_tlb_single+0x6c/0x80
[  388.893698]  [<edf2b0ab>] ? zram_free_page+0x6b/0x110 [zram]
[  388.893707]  [<c022e977>] ? swap_cgroup_record+0x67/0x80
[  388.893715]  [<edf2b16c>] ? zram_slot_free_notify+0x1c/0x30 [zram]
[  388.893723]  [<c022e2f7>] ? mem_cgroup_uncharge_swap+0x27/0x70
[  388.893731]  [<c0218cd3>] ? swap_entry_free+0xf3/0x170
[  388.893739]  [<c0637000>] ? _raw_spin_trylock_bh+0x20/0x30
[  388.893747]  [<edf2b150>] ? zram_slot_free_notify+0x0/0x30 [zram]
[  388.893756]  [<c021a5ab>] ? swapcache_free+0x2b/0x60
[  388.893764]  [<c02181d2>] ? delete_from_swap_cache+0x42/0x60
[  388.893772]  [<c021aebf>] ? free_swap_and_cache+0xbf/0x100
[  388.893780]  [<c0209d73>] ? zap_pte_range+0x2d3/0x410
[  388.893788]  [<c0105755>] ? pte_pfn_to_mfn+0x85/0xa0
[  388.893796]  [<c0209fc5>] ? unmap_page_range+0x115/0x1b0
[  388.893804]  [<c020a627>] ? unmap_vmas+0x137/0x280
[  388.893812]  [<c02109fe>] ? exit_mmap+0x9e/0x160
[  388.893820]  [<c0156c1b>] ? mmput+0x3b/0xd0
[  388.893826]  [<c015cd0e>] ? exit_mm+0xfe/0x130
[  388.893833]  [<c015ce59>] ? do_exit+0x119/0x350
[  388.893840]  [<c015d1ee>] ? do_group_exit+0x3e/0xa0
[  388.893848]  [<c015d268>] ? sys_exit_group+0x18/0x20
[  388.893855]  [<c0637464>] ? syscall_call+0x7/0xb
Xen Minimal OS!
  start_info: 0xb1a000(VA)
    nr_pages: 0x6cc00
  shared_inf: 0x00266000(MA)
     pt_base: 0xb1d000(VA)
nr_pt_frames: 0x9
    mfn_list: 0x967000(VA)
   mod_start: 0x0(VA)
     mod_len: 0
       flags: 0x0
    cmd_line:  root=/dev/sda1 ro 4
  stack:      0x946780-0x966780
MM: Init
      _text: 0x0(VA)
     _etext: 0x621f5(VA)
   _erodata: 0x76000(VA)
     _edata: 0x7b6d4(VA)
stack start: 0x946780(VA)
       _end: 0x966d34(VA)
  start_pfn: b29
    max_pfn: 6cc00
Mapping memory range 0xc00000 - 0x6cc00000
setting 0x0-0x76000 readonly
skipped 0x1000
MM: Initialise page allocator for e8a000(e8a000)-0(6cc00000)
MM: done
Demand map pfns at 6cc01000-7cc01000.
Heap resides at 7cc02000-bcc02000.
Initialising timer interface
Initialising console ... done.
gnttab_table mapped at 0x6cc01000.
Initialising scheduler
Thread "Idle": pointer: 0x7cc02008, stack: 0x6c850000
Initialising xenbus
Thread "xenstore": pointer: 0x7cc02478, stack: 0x6c860000
Dummy main: start_info=0x966880
Thread "main": pointer: 0x7cc028e8, stack: 0x6c870000
"main" "root=/dev/sda1" "ro" "4"
Original issue reported on code.google.com by tboc...@gmail.com on 14 Sep 2011 at 9:14
kowr / compcache

kernel BUG at /usr/src/linux-source-2.6.38/drivers/staging/zram/xvmalloc.c:433! #96
