Hello, Testing the scullwuid produced attached crash logs. Combination of read and write using "dd" and "cat" caused this problem. I don't exactly remember exactly what caused the problem but combination of read and write did it. Reproduction would not be possible but just want to know why this happened as anyone looking into the code would come to the conclusion that proper locking is in place. Below is small part of the crash logs: [21028.412827] BUG: unable to handle kernel paging request at 00300d04 [21028.412832] IP: [<c035aef7>] _copy_from_user+0x97/0x130 [21028.412839] *pde = 6fa0b067 [21028.412842] Oops: 0003 [#1] SMP [21028.412933] Call Trace: [21028.412940] [<f9f24d84>] ? scull_write+0x193/0x204 [scull] [21028.412946] [<c0218fc2>] ? vfs_write+0xa2/0x190 [21028.412949] [<f9f24bf1>] ? scull_write+0x0/0x204 [scull] [21028.412953] [<c0219882>] ? sys_write+0x42/0x70 [21028.412958] [<c05cadd4>] ? syscall_call+0x7/0xb [21028.412963] [<c05c0000>] ? calibrate_delay_direct+0x5a/0xfb Some of the below code is removed for fitting it into this mail: ssize_t scull_write(struct file *filp, const char __user *buf, size_t count, loff_t *f_pos) { if (down_interruptible(&dev->sem)) return -ERESTARTSYS; dptr = scull_follow(dev, item); if (dptr == NULL) goto out; if (!dptr->data) { dptr->data = kmalloc(qset * sizeof(char *), GFP_KERNEL); if (!dptr->data) goto out; memset(dptr->data, 0, qset * sizeof(char *)); } if (!dptr->data[s_pos]) { dptr->data[s_pos] = kmalloc(quantum, GFP_KERNEL); if (!dptr->data[s_pos]) goto out; /* write only up to the end of this quantum */ if (count > quantum - q_pos) count = quantum - q_pos; if (copy_from_user(dptr->data[s_pos]+q_pos, buf, count)) { retval = -EFAULT; goto out; } Used: https://github.com/martinezjavier/ldd3 box:Ubuntu 10.10 |2.6.35-27-generic #48-Ubuntu SMP i686 GNU/Linux --thanks