1. 21 4月, 2015 1 次提交
  2. 25 11月, 2014 7 次提交
  3. 22 9月, 2014 1 次提交
    • H
      [media] videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages · 47bc59c5
      Hans Verkuil 提交于
      sg_alloc_table_from_pages() only allocates a sg_table, so it should just use
      GFP_KERNEL, not gfp_flags. If gfp_flags contains __GFP_DMA32 then mm/sl[au]b.c
      will call BUG_ON:
      
      [  358.027515] ------------[ cut here ]------------
      [  358.027546] kernel BUG at mm/slub.c:1416!
      [  358.027558] invalid opcode: 0000 [#1] PREEMPT SMP
      [  358.027576] Modules linked in: mt2131 s5h1409 tda8290 tuner cx25840 cx23885 btcx_risc altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core nouveau zr36067 videocodec v4l2_common videodev media x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci
      [  358.027712] CPU: 19 PID: 3654 Comm: cat Not tainted 3.16.0-rc6-telek #167
      [  358.027723] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014
      [  358.027741] task: ffff880897c7d960 ti: ffff88089b4d4000 task.ti: ffff88089b4d4000
      [  358.027753] RIP: 0010:[<ffffffff81196040>]  [<ffffffff81196040>] new_slab+0x280/0x320
      [  358.027776] RSP: 0018:ffff88089b4d7ae8  EFLAGS: 00010002
      [  358.027787] RAX: ffff880897c7d960 RBX: 0000000000000000 RCX: ffff88089b4d7b50
      [  358.027798] RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88089f803b00
      [  358.027809] RBP: ffff88089b4d7bb8 R08: 0000000000000000 R09: 0000000100400040
      [  358.027821] R10: 0000160000000000 R11: ffff88109bc02c40 R12: 0000000000000001
      [  358.027832] R13: ffff88089f8000c0 R14: ffff88089f803b00 R15: ffff8810bfcf4be0
      [  358.027845] FS:  00007f83fe5c0700(0000) GS:ffff8810bfce0000(0000) knlGS:0000000000000000
      [  358.027858] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  358.027868] CR2: 0000000001dfd568 CR3: 0000001097d5a000 CR4: 00000000000407e0
      [  358.027878] Stack:
      [  358.027885]  ffffffff81198860 ffff8810bfcf4be0 ffff880897c7d960 0000000000001b00
      [  358.027905]  ffff880897c7d960 0000000000000000 ffff8810bfcf4bf0 0000000000000000
      [  358.027924]  0000000000000000 0000000100000100 ffffffff813ef84a 00000004ffffffff
      [  358.027944] Call Trace:
      [  358.027956]  [<ffffffff81198860>] ? __slab_alloc+0x400/0x4e0
      [  358.027973]  [<ffffffff813ef84a>] ? sg_kmalloc+0x1a/0x30
      [  358.027985]  [<ffffffff81198f17>] __kmalloc+0x127/0x150
      [  358.027997]  [<ffffffff813ef84a>] ? sg_kmalloc+0x1a/0x30
      [  358.028009]  [<ffffffff813ef84a>] sg_kmalloc+0x1a/0x30
      [  358.028023]  [<ffffffff813eff84>] __sg_alloc_table+0x74/0x180
      [  358.028035]  [<ffffffff813ef830>] ? sg_kfree+0x20/0x20
      [  358.028048]  [<ffffffff813f00af>] sg_alloc_table+0x1f/0x60
      [  358.028061]  [<ffffffff813f0174>] sg_alloc_table_from_pages+0x84/0x1f0
      [  358.028077]  [<ffffffffa007c3f9>] vb2_dma_sg_alloc+0x159/0x230 [videobuf2_dma_sg]
      [  358.028095]  [<ffffffffa003d55a>] __vb2_queue_alloc+0x10a/0x680 [videobuf2_core]
      [  358.028113]  [<ffffffffa003e110>] __reqbufs.isra.14+0x220/0x3e0 [videobuf2_core]
      [  358.028130]  [<ffffffffa003e79d>] __vb2_init_fileio+0xbd/0x380 [videobuf2_core]
      [  358.028147]  [<ffffffffa003f563>] __vb2_perform_fileio+0x5b3/0x6e0 [videobuf2_core]
      [  358.028164]  [<ffffffffa003f871>] vb2_fop_read+0xb1/0x100 [videobuf2_core]
      [  358.028184]  [<ffffffffa06dd2e5>] v4l2_read+0x65/0xb0 [videodev]
      [  358.028198]  [<ffffffff811a243f>] vfs_read+0x8f/0x170
      [  358.028210]  [<ffffffff811a30a1>] SyS_read+0x41/0xb0
      [  358.028224]  [<ffffffff818f02e9>] system_call_fastpath+0x16/0x1b
      [  358.028234] Code: 66 90 e9 dc fd ff ff 0f 1f 40 00 41 8b 4d 68 e9 d5 fe ff ff 0f 1f 80 00 00 00 00 f0 41 80 4d 00 40 e9 03 ff ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 44 89 c6 4c 89 45 d0 e8 0c 82 ff ff 48
      [  358.028415] RIP  [<ffffffff81196040>] new_slab+0x280/0x320
      [  358.028432]  RSP <ffff88089b4d7ae8>
      [  358.032208] ---[ end trace 6443240199c706e4 ]---
      Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
      Cc: stable@vger.kernel.org      # for v3.13 and up
      Acked-by: NMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      47bc59c5
  4. 23 5月, 2014 1 次提交
    • R
      [media] videobuf2-dma-sg: Fix NULL pointer dereference BUG · 227ae227
      Ricardo Ribalda 提交于
      vb2_get_vma() copy the content of the vma to a new structure but set
      some of its pointers to NULL.
      
      One of this pointer is used by follow_pte() called by follow_pfn()
      on io memory.
      
      This can lead to a NULL pointer derreference.
      
      The version of vma that has not been cleared must be used.
      
      [  406.143320] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
      [  406.143427] IP: [<ffffffff8115204c>] follow_pfn+0x2c/0x70
      [  406.143491] PGD 6c3f0067 PUD 6c3ef067 PMD 0
      [  406.143546] Oops: 0000 [#1] SMP
      [  406.143587] Modules linked in: qtec_mem qt5023_video qtec_testgen qtec_xform videobuf2_core gpio_xilinx videobuf2_vmalloc videobuf2_dma_sg qtec_cmosis videobuf2_memops qtec_pcie qtec_white fglrx(PO) qt5023 spi_xilinx spi_bitbang
      [  406.143852] CPU: 0 PID: 299 Comm: tracker Tainted: P           O 3.13.0-qtec-standard #10
      [  406.143927] Hardware name: QTechnology QT5022/QT5022, BIOS PM_2.1.0.309 X64 04/04/2013
      [  406.144000] task: ffff880085c82d60 ti: ffff880085abe000 task.ti: ffff880085abe000
      [  406.144067] RIP: 0010:[<ffffffff8115204c>]  [<ffffffff8115204c>] follow_pfn+0x2c/0x70
      [  406.144145] RSP: 0018:ffff880085abf888  EFLAGS: 00010296
      [  406.144195] RAX: 0000000000000000 RBX: ffff880085abf8e0 RCX: ffff880085abf888
      [  406.144260] RDX: ffff880085abf890 RSI: 00007fc52e173000 RDI: ffff8800863cbe40
      [  406.144325] RBP: ffff880085abf8a8 R08: 0000000000000018 R09: ffff8800863cbf00
      [  406.144388] R10: ffff880086703b80 R11: 00000000000001e0 R12: 0000000000018000
      [  406.144452] R13: 0000000000000000 R14: ffffea0000000000 R15: ffff88015922fea0
      [  406.144517] FS:  00007fc536e7c740(0000) GS:ffff88015ec00000(0000) knlGS:0000000000000000
      [  406.144591] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  406.144644] CR2: 0000000000000040 CR3: 0000000066c9d000 CR4: 00000000000007f0
      [  406.144708] Stack:
      [  406.144731]  0000000000018000 00007fc52e18b000 0000000000000000 00007fc52e173000
      [  406.144813]  ffff880085abf918 ffffffffa083b2fd ffff880085ab1ba8 0000000000000000
      [  406.144894]  0000000000000000 0000000100000000 ffff880085abf928 ffff880159a20800
      [  406.144976] Call Trace:
      [  406.145011]  [<ffffffffa083b2fd>] vb2_dma_sg_get_userptr+0x14d/0x310 [videobuf2_dma_sg]
      [  406.145089]  [<ffffffffa08507df>] __qbuf_userptr+0xbf/0x3e0 [videobuf2_core]
      [  406.147229]  [<ffffffffa0041454>] ? mc_heap_lock_memory+0x1f4/0x490 [fglrx]
      [  406.149234]  [<ffffffff813428f3>] ? cpumask_next_and+0x23/0x50
      [  406.151223]  [<ffffffff810b2e38>] ? enqueue_task_fair+0x658/0xde0
      [  406.153199]  [<ffffffff81061888>] ? native_smp_send_reschedule+0x48/0x60
      [  406.155184]  [<ffffffff815836b9>] ? get_ctrl+0xa9/0xd0
      [  406.157161]  [<ffffffff8116f4e4>] ? __kmalloc+0x1a4/0x1b0
      [  406.159135]  [<ffffffffa0850b9c>] ? __vb2_queue_alloc+0x9c/0x4a0 [videobuf2_core]
      [  406.161130]  [<ffffffffa0852d08>] __buf_prepare+0x1a8/0x210 [videobuf2_core]
      [  406.163171]  [<ffffffffa0854c57>] __vb2_qbuf+0x27/0xcc [videobuf2_core]
      [  406.165229]  [<ffffffffa0851dfd>] vb2_queue_or_prepare_buf+0x1ed/0x270 [videobuf2_core]
      [  406.167325]  [<ffffffffa0854c30>] ? vb2_ioctl_querybuf+0x30/0x30 [videobuf2_core]
      [  406.169419]  [<ffffffffa0851e9c>] vb2_qbuf+0x1c/0x20 [videobuf2_core]
      [  406.171508]  [<ffffffffa0851ef8>] vb2_ioctl_qbuf+0x58/0x70 [videobuf2_core]
      [  406.173604]  [<ffffffff8157d3a8>] v4l_qbuf+0x48/0x60
      [  406.175681]  [<ffffffff8157b29c>] __video_do_ioctl+0x2bc/0x340
      [  406.177779]  [<ffffffff8116f43c>] ? __kmalloc+0xfc/0x1b0
      [  406.179883]  [<ffffffff8157cd0e>] ? video_usercopy+0x7e/0x470
      [  406.181961]  [<ffffffff8157ce81>] video_usercopy+0x1f1/0x470
      [  406.184021]  [<ffffffff8157afe0>] ? v4l_printk_ioctl+0xb0/0xb0
      [  406.186085]  [<ffffffff810ae1ed>] ? account_system_time+0x8d/0x190
      [  406.188149]  [<ffffffff8157d115>] video_ioctl2+0x15/0x20
      [  406.190216]  [<ffffffff815781b3>] v4l2_ioctl+0x123/0x160
      [  406.192251]  [<ffffffff810ce415>] ? rcu_eqs_enter+0x65/0xa0
      [  406.194256]  [<ffffffff81186b28>] do_vfs_ioctl+0x88/0x560
      [  406.196258]  [<ffffffff810ae145>] ? account_user_time+0x95/0xb0
      [  406.198262]  [<ffffffff810ae6a4>] ? vtime_account_user+0x44/0x70
      [  406.200215]  [<ffffffff81187091>] SyS_ioctl+0x91/0xb0
      [  406.202107]  [<ffffffff817be109>] tracesys+0xd0/0xd5
      [  406.203946] Code: 66 66 66 90 48 f7 47 50 00 44 00 00 b8 ea ff ff ff 74 52 55 48 89 e5 53 48 89 d3 48 8d 4d e0 48 8d 55 e8 48 83 ec 18 48 8b 47 40 <48> 8b 78 40 e8 8b fe ff ff 85 c0 75 27 48 8b 55 e8 48 b9 00 f0
      [  406.208011] RIP  [<ffffffff8115204c>] follow_pfn+0x2c/0x70
      [  406.209908]  RSP <ffff880085abf888>
      [  406.211760] CR2: 0000000000000040
      [  406.213676] ---[ end trace 996d9f64e6739a04 ]---
      Signed-off-by: NRicardo Ribalda Delgado <ricardo.ribalda@gmail.com>
      Acked-by: NMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>
      227ae227
  5. 10 12月, 2013 1 次提交
  6. 09 12月, 2013 2 次提交
  7. 26 9月, 2013 2 次提交
  8. 25 4月, 2013 1 次提交
  9. 22 3月, 2013 2 次提交
  10. 14 8月, 2012 1 次提交
  11. 31 12月, 2011 1 次提交
  12. 03 9月, 2011 1 次提交
  13. 28 7月, 2011 1 次提交
  14. 01 7月, 2011 1 次提交
  15. 22 3月, 2011 3 次提交