Messages in this thread | | | Date | Wed, 15 Mar 2006 09:48:45 +0100 | From | Jiri Tyr <> | Subject | Re: PROBLEM: four bttv tuners in one PC crashed |
| |
Hi,
I think, it's problem in XAWTV, because I've got the same error if I had only one TV tuner in my PC. I've solved the problem that I reduced number of items in channel list. If I have in the list only 10 channels, then any of the four XAWTV didn't crashed. It's very strange. It looks like the pop-up menu with the channel list write to the memory of the graphics card somewhere out of the memory. What do you think about it?
Jiri
Sami Farin wrote: >On Sat, Mar 11, 2006 at 11:08:25AM +0100, Bodo Eggert wrote: >> Duncan Sands <duncan.sands@math.u-psud.fr> wrote: >> >> >> The bttv driver/chip seems to cause random memory corruption sometimes, >> >> processes will just start dying... >> > >> > There is a known buffer overflow in the bttv driver (when using >> > grabdisplay). The fix is waiting on an audit of the rest of the >> > bttv (and similar) code, since it looks like the same mistake >> > occurs in several places. >> >> Can you give me a hint on where exactly to shoot at? I'n still hoping it's >> not my VIA board giving me trouble (corrupting the first four bytes of a >> semi-random page). > >check out this email to LKML > >it might not be the Final Fix, but xawtv hasn't crashed on me yet > >From: Duncan Sands <duncan.sands@math.u-psud.fr> >Subject: [PATCH] bttv: correct bttv_risc_packed buffer size >Date: Wed, 25 Jan 2006 11:24:27 +0100 >Cc: Linux Kernel list <linux-kernel@vger.kernel.org> >MIME-Version: 1.0 >Content-Type: Multipart/Mixed; > boundary="Boundary-00=_cH11D22lqYSaiQl" >Message-Id: <200601251124.28392.duncan.sands@math.u-psud.fr> > > >This patch fixes the strange crashes I was seeing after using >my bttv card to watch television. They were caused by a >buffer overflow in bttv_risc_packed. > >The instruction buffer size calculation contains two errors: >(a) a non-zero padding value can push the start of the next bpl >section to just before a page border, leading to more scanline >splits and thus additional instructions. >(b) the first DMA region can be smaller than one page, so there can >be a scanline split even if bpl*lines is smaller than PAGE_SIZE. > >For example, consider the case where offset is 0, bpl is 2, padding >is 4094, lines is smaller than 2048, the first DMA region has size 1 >and all others have size PAGE_SIZE, assumed to equal 4096. Then >all bpl regions cross page borders and the number of instructions >written is 2*lines+2, rather than lines+2 (the current estimate). >With this patch the number of instructions for this example is >estimated to be 2*lines+3. > >Also, the BUG_ON that was supposed to catch buffer overflows contained >a thinko causing it fire only if the buffer was overrun by a factor of >16 or more. > >I didn't check whether similar mistakes exist elsewhere in the bttv >code. > >Signed-off-by: Duncan Sands <baldrick@free.fr> > >PS: I'm sending the patch as an attachment because for some reason my >mailer crashes if I try to insert it into the email. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |