<br><br><div class="gmail_quote">On Thu, Jan 1, 2009 at 4:53 PM, Mark Jenks <span dir="ltr"><<a href="mailto:mjenks1968@gmail.com">mjenks1968@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class="Wj3C7c"><br><br><div class="gmail_quote">On Thu, Jan 1, 2009 at 3:18 PM, Andy Walls <span dir="ltr"><<a href="mailto:awalls@radix.net" target="_blank">awalls@radix.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Thu, 2009-01-01 at 12:34 -0600, Mark Jenks wrote:<br>
<br>
<br>
<br>
> Well, I patched it, make clean, make, make install, and a reboot.<br>
><br>
> BUG: unable to handle kernel NULL pointer dereference at 00000168<br>
> IP: [<f0e2571c>] :cx23885:mpeg_open+0x41/0xc0<br>
> *pde = 00000000<br>
> Oops: 0000 [#1] SMP<br>
<br>
</div>Same failure mode, different place in the driver:<br>
<br>
linux/drivers/media/video/cx23885/cx23885-417.c:mpeg_open():<br>
<br>
static int mpeg_open(struct file *file)<br>
{<br>
[...]<br>
<div> lock_kernel();<br>
list_for_each(list, &cx23885_devlist) {<br>
h = list_entry(list, struct cx23885_dev,<br>
devlist);<br>
</div> if (h->v4l_device->minor == minor) {<br>
dev = h;<br>
[...]<br>
<br>
"h->v4l_device" is likely NULL here for one device due to one card<br>
having analog support in the driver and the other not having analog<br>
support in the driver.<br>
<br>
The fix for this is analogous to the previous fix.<br>
<br>
Those are the only two places in the driver the cx23885_devlist is<br>
iterated over, so hopefully every other instance of system will know<br>
what type of device it it dealing with and v4l_device and video_dev will<br>
only be used when well defined.<br>
<br>
Fix, Test, Repeat...<br>
<br>
Regards,<br>
<font color="#888888">Andy<br>
</font><div><div></div><div><br>
<br>
<br>
<br>
> Modules linked in: cpufreq_conservative cpufreq_userspace<br>
> cpufreq_powersave powernow_k8 xfs loop dm_mod cx25840 mt2131 s5h1409<br>
> cx23885 v4l2_compat_ioctl32 nvidia(P) snd_mpu401 cx2341x<br>
> videobuf_dma_sg videobuf_dvb dvb_core videobuf_core snd_usb_audio<br>
> snd_usb_lib snd_cs4232 snd_opl3_lib v4l2_common videodev agpgart<br>
> snd_hwdep lirc_mceusb2 snd_cs4231_lib snd_mpu401_uart snd_rawmidi<br>
> snd_hda_intel snd_pcm parport_pc ohci1394 snd_timer k8temp osst<br>
> v4l1_compat snd_seq_device hwmon snd button i2c_nforce2 lirc_dev<br>
> parport ieee1394 st forcedeth sr_mod cdrom rtc_cmos rtc_core btcx_risc<br>
> tveeprom i2c_core snd_page_alloc soundcore rtc_lib sg usbhid hid<br>
> ff_memless ohci_hcd ehci_hcd usbcore sd_mod edd ext3 mbcache jbd fan<br>
> aic7xxx scsi_transport_spi sata_nv pata_amd libata scsi_mod dock<br>
> thermal processor thermal_sys<br>
><br>
> Pid: 2876, comm: X Tainted: P (2.6.27.10-default #3)<br>
> EIP: 0060:[<f0e2571c>] EFLAGS: 00013287 CPU: 1<br>
> EIP is at mpeg_open+0x41/0xc0 [cx23885]<br>
> EAX: 00000000 EBX: ef1fd000 ECX: f0e308a8 EDX: ef3be000<br>
> ESI: 00000001 EDI: ef189980 EBP: efba1790 ESP: efe93e84<br>
> DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068<br>
> Process X (pid: 2876, ti=efe92000 task=ef1e5070 task.ti=efe92000)<br>
> Stack: efbf5a00 efbf5a04 ef189980 f0d775b8 00000000 ef3876c0 00000000<br>
> efba1790<br>
> c016bee5 ef189980 00000000 ef189980 efba1790 00000000 c016bdd9<br>
> c01683cd<br>
> ef81ebc0 ef504c6c efe93f14 ef189980 efe93f14 00000003 c01684d8<br>
> ef189980<br>
> Call Trace:<br>
> [<f0d775b8>] v4l2_open+0x62/0x76 [videodev]<br>
> [<c016bee5>] chrdev_open+0x10c/0x122<br>
> [<c016bdd9>] chrdev_open+0x0/0x122<br>
> [<c01683cd>] __dentry_open+0x10d/0x1fc<br>
> [<c01684d8>] nameidata_to_filp+0x1c/0x2c<br>
> [<c0172986>] do_filp_open+0x33d/0x63e<br>
> [<f1aad8ce>] _nv004117rm+0x9/0x12 [nvidia]<br>
> [<c01582f8>] handle_mm_fault+0x2b3/0x5dd<br>
> [<f0dcf391>] __videobuf_mmap_free+0x3e/0x7d [videobuf_core]<br>
> [<c017ab2d>] alloc_fd+0x57/0xd3<br>
> [<c01681e8>] do_sys_open+0x3f/0xb8<br>
> [<c01682a5>] sys_open+0x1e/0x23<br>
> [<c01037ad>] sysenter_do_call+0x12/0x21<br>
> =======================<br>
> Code: 17 68 38 7a e2 f0 68 c8 0a 00 00 68 ee a2 e2 f0 e8 51 aa 2f cf<br>
> 83 c4 0c e8 88 66 49 cf 8b 1d a0 fd e2 f0 eb 10 8b 83 c4 0e 00 00 <39><br>
> b0 68 01 00 00 74 1c 89 d3 8b 13 0f 18 02 90 81 fb a0 fd e2<br>
> EIP: [<f0e2571c>] mpeg_open+0x41/0xc0 [cx23885] SS:ESP 0068:efe93e84<br>
> ---[ end trace 1bdce38cbcdc8781 ]---<br>
><br>
><br>
><br>
<br>
</div></div></blockquote></div><br></div></div>So, now that I have it fixed. I have no idea how to submit a patch for what just happened.<br><font color="#888888"><br>-Mark</font></blockquote><div><br>--- a/linux/drivers/media/video/cx23885/cx23885-417.c 2009-01-01 14:27:15.0000<br>
00000 -0600<br>+++ b/linux/drivers/media/video/cx23885/cx23885-417.c 2009-01-01 14:27:39.0000<br>00000 -0600<br>@@ -1593,7 +1593,8 @@<br> lock_kernel();<br> list_for_each(list, &cx23885_devlist) {<br> h = list_entry(list, struct cx23885_dev, devlist);<br>
- if (h->v4l_device->minor == minor) {<br>+ if (h->v4l_device &&<br>+ h->v4l_device->minor == minor) {<br> dev = h;<br> break;<br>
}<br> </div></div><br>