From: Florian Mickler <florian@mickler.org>
To: Dan Carpenter <error27@gmail.com>
Cc: linux-kernel@vger.kernel.org, Tino Keitel <tino.keitel@tikei.de>,
mchehab@infradead.org
Subject: Re: USB related "unable to handle kernel paging request" in 3.0.0-rc7
Date: Tue, 2 Aug 2011 11:51:45 +0200 [thread overview]
Message-ID: <20110802115145.25b6a445@schatten.dmk.lab> (raw)
In-Reply-To: <20110802085447.GA4522@shale.localdomain>
On Tue, 2 Aug 2011 11:54:47 +0300
Dan Carpenter <error27@gmail.com> wrote:
> Looking at this, I noticed a memory corruption bug introduce in:
> ab22cbda6651d "[media] vp7045: get rid of on-stack dma buffers"
>
> vp7045_properties.size_of_priv is sizeof(u8 *) so in vp7045_usb_probe()
> the d->priv buffer gets allocated twice. Once in:
> dvb_usb_device_init()
> -> dvb_usb_init()
>
> And once explicitly to a larger buffer later on in the function with
> a kmalloc().
>
> So the two places that use the buffer will probably race and cause
> memory corruption.
>
> regards,
> dan carpenter
Damn. That (u8*)sized priv buffer should only hold a pointer to the
transfer buffer allocated in the prope routine. But I botched that.
I will send a fixup in a minute.
Regards,
Flo
next prev parent reply other threads:[~2011-08-02 9:51 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-22 19:27 USB related "unable to handle kernel paging request" in 3.0.0-rc7 Tino Keitel
2011-07-25 19:47 ` Maciej Rutecki
2011-08-02 8:54 ` Dan Carpenter
2011-08-02 9:51 ` Florian Mickler [this message]
2011-08-02 10:40 ` Florian Mickler
2011-08-02 11:10 ` Florian Mickler
2011-08-02 11:51 ` Florian Mickler
2011-08-02 11:56 ` Dan Carpenter
2011-08-02 11:35 ` Dan Carpenter
2011-08-02 11:40 ` Dan Carpenter
2011-08-02 12:02 ` Florian Mickler
2011-08-02 12:29 ` [PATCH] [media] vp7045: fix buffer setup Florian Mickler
2011-08-03 19:02 ` Tino Keitel
2011-08-09 20:08 ` Tino Keitel
2011-08-10 9:46 ` Florian Mickler
2011-08-10 10:05 ` Florian Mickler
2011-08-19 16:35 ` Florian Mickler
2011-08-24 16:26 ` Tino Keitel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110802115145.25b6a445@schatten.dmk.lab \
--to=florian@mickler.org \
--cc=error27@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@infradead.org \
--cc=tino.keitel@tikei.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox