Re: your mail

Linus Torvalds
2003-12-26T22:27:46Z

On Fri, 26 Dec 2003 caszonyi@rdslink.ro wrote:
>
> I was trying to capture a tv program with mencoder when the oops occured
> a couple of hours later the system froze without leaving a single trace
> in logs. I was able to reboot with SysRq.
>
> Programs versions, config and dmesg are attached.

Looks like this loop:

....
while (voffset >= sg_dma_len(vsg)) {
voffset -= sg_dma_len(vsg);
vsg++;
}
....

and in particular, it's the "sg_dma_len()" access that oopses, apparently
because vsg was stale to begin with, or because it incremented past the
last pointer.

The pointer that fails (0xc4bea00c) looks reasonable, so it's almost
certainly due to CONFIG_PAGE_DEBUG showing some kind of use-after-free
problem (ie the pointer is stale, and the memory has already been freed).

I suspect the problem is that

"voffset >= sg_dma_len(vsg)"

test: if "voffset" is _exactly_ the same as sg_dma_len(), then we will
test one more iteration (when "voffset" is 0), and that iteration may be
past the end of the "vsg" array.

I suspect the fix might be to change the test to

"voffset && voffset >= sg_dma_len(vsg)"

to make sure that we never access vsg past the end of the array.

Linus