Messages in this thread | | | Date | Fri, 26 Feb 2010 13:27:45 +0300 | From | Dan Carpenter <> | Subject | Re: Buggy variable-length array code...or compiler? |
| |
On Thu, Feb 25, 2010 at 03:46:48PM -0800, David Rientjes wrote: > On Thu, 25 Feb 2010, Steven J. Magnani wrote: > > > When I run a memcpy dmatest with a Microblaze 2.6.33 noMMU kernel, the > > system crashes after about 400 iterations. After much head scratching, I > > believe I've narrowed the problem to this fragment of code in > > drivers/dma/dmatest.c: > > > > static int dmatest_func(void *data) > > { > > struct dmatest_thread *thread = data; > > ... > > unsigned int total_tests = 0; > > int src_cnt; > > int dst_cnt; > > > > ... > > if (thread->type == DMA_MEMCPY) > > src_cnt = dst_cnt = 1; > > ... > > > > while (!kthread_should_stop() > > && !(iterations && total_tests >= iterations)) { > > struct dma_device *dev = chan->device; > > struct dma_async_tx_descriptor *tx = NULL; > > dma_addr_t dma_srcs[src_cnt]; > > dma_addr_t dma_dsts[dst_cnt]; > > > > ... > > total_tests++; > > > > /* CODE ADDED BY ME FOR DEBUG */ > > printk("dmatest: Iteration %d, dma_srcs = %p\n", > > total_tests, dma_srcs); > > > > ... > > } > > > > With this code I get output like this: > > > > dmatest: Iteration 1, dma_srcs = 2c963ee8 > > dmatest: Iteration 2, dma_srcs = 2c963ed8 > > dmatest: Iteration 3, dma_srcs = 2c963ec8 > > dmatest: Iteration 4, dma_srcs = 2c963eb8 > > ... > > dmatest: Iteration 420, dma_srcs = 2c9624b8 > > > > ...and then the stack detonates and the kernel crashes with some strange > > error or other. > > > > This could probably become the first kernel user of the flexible array > library (see Documentation/flexible-arrays.txt). Dan? > --
I think the max that src_cnt can be is 3 and the most dst_cnt can be is 2. We could just put that there.
regards, dan carpenter
| |