OOPS in forcedeth

["Carlos Martín" <carlos@cmartin.tk>]

[-- Attachment #1: Type: text/plain, Size: 1478 bytes --]

Hi,

I just saw this last night when my desktop was shutting down. Not all 
the OOPS was outputted, but I've found where it happens.

in forcedeth.c:1583 we see:
		pci_unmap_single(np->pci_dev, np->rx_dma[i],
				np->rx_skbuff[i]->end-np->rx_skbuff[i]->data,
				PCI_DMA_FROMDEVICE);

The assembler output is:

        movslq  %r12d,%rcx      # i, i
        xorl    %edi, %edi      # tmp226
        movq    320(%rbp,%rcx,8), %rax  # <variable>.rx_skbuff, D.20431
        movq    1344(%rbp,%rcx,8), %rsi # <variable>.rx_dma, addr
OOPS--->movq    216(%rax), %rdx # <variable>.end, <variable>.end
        subq    200(%rax), %rdx # <variable>.data, <variable>.end
        movq    256(%rbp), %rax # <variable>.pci_dev, hwdev
        testq   %rax, %rax      # hwdev
        leaq    112(%rax), %rcx #, tmp225
        movq    dma_ops(%rip), %rax     # dma_ops, dma_ops
        cmovne  %rcx, %rdi      # tmp225,, tmp226
        movl    $2, %ecx        #,
        call    *40(%rax)       # <variable>.unmap_single

 Which I think comes from dereferencing np->rx_skbuff[i]. I've not found 
a reproducible way of doing this, and I've at times come back to my 
room to find out that this computer has been forcibly shut down.

 I'm not familiar with this code. I hope someone here understands how 
this can happen. I'll try to find a way to reproduce this meanwhile.

   cmn
-- 
Carlos Martín Nieto    |   http://www.cmartin.tk
Hobbyist programmer    |

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]