lkml.org 
[lkml]   [2003]   [Dec]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: your mail


On Fri, 26 Dec 2003 caszonyi@rdslink.ro wrote:
>
> I was trying to capture a tv program with mencoder when the oops occured
> a couple of hours later the system froze without leaving a single trace
> in logs. I was able to reboot with SysRq.
>
> Programs versions, config and dmesg are attached.

Looks like this loop:

....
while (voffset >= sg_dma_len(vsg)) {
voffset -= sg_dma_len(vsg);
vsg++;
}
....

and in particular, it's the "sg_dma_len()" access that oopses, apparently
because vsg was stale to begin with, or because it incremented past the
last pointer.

The pointer that fails (0xc4bea00c) looks reasonable, so it's almost
certainly due to CONFIG_PAGE_DEBUG showing some kind of use-after-free
problem (ie the pointer is stale, and the memory has already been freed).

I suspect the problem is that

"voffset >= sg_dma_len(vsg)"

test: if "voffset" is _exactly_ the same as sg_dma_len(), then we will
test one more iteration (when "voffset" is 0), and that iteration may be
past the end of the "vsg" array.

I suspect the fix might be to change the test to

"voffset && voffset >= sg_dma_len(vsg)"

to make sure that we never access vsg past the end of the array.


Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2009-11-18 23:46    [W:0.063 / U:0.032 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site