Messages in this thread | | | Date | Tue, 2 Aug 2011 11:51:45 +0200 | From | Florian Mickler <> | Subject | Re: USB related "unable to handle kernel paging request" in 3.0.0-rc7 |
| |
On Tue, 2 Aug 2011 11:54:47 +0300 Dan Carpenter <error27@gmail.com> wrote:
> Looking at this, I noticed a memory corruption bug introduce in: > ab22cbda6651d "[media] vp7045: get rid of on-stack dma buffers" > > vp7045_properties.size_of_priv is sizeof(u8 *) so in vp7045_usb_probe() > the d->priv buffer gets allocated twice. Once in: > dvb_usb_device_init() > -> dvb_usb_init() > > And once explicitly to a larger buffer later on in the function with > a kmalloc(). > > So the two places that use the buffer will probably race and cause > memory corruption. > > regards, > dan carpenter
Damn. That (u8*)sized priv buffer should only hold a pointer to the transfer buffer allocated in the prope routine. But I botched that. I will send a fixup in a minute.
Regards, Flo
| |