mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Martin J. Bligh" <mbligh@aracnet.com>
To: linux-kernel <linux-kernel@vger.kernel.org>
Cc: herbert@gondor.apana.org.au
Subject: [Bug 2748] New: Missing locks in video1394_ioctl
Date: Sat, 22 May 2004 08:11:36 -0700	[thread overview]
Message-ID: <7560000.1085238696@[10.10.2.4]> (raw)

http://bugme.osdl.org/show_bug.cgi?id=2748

           Summary: Missing locks in video1394_ioctl
    Kernel Version: 2.6.6
            Status: NEW
          Severity: normal
             Owner: bcollins@debian.org
         Submitter: herbert@gondor.apana.org.au


This bug was reported at http://bugs.debian.org/248996.

The last few messages are:

video1394_0: Iso receive DMA: 8 buffers of size 614400 allocated for a frame sis
video1394_0: iso context 1 listen on channel 0
video1394_0: Waking up iso dma ctx=1
video1394_0: Buffer 3 is already used
video1394_0: Iso context 1 stop talking on channel 0
NMI Watchdog detected LOCKUP on CPU1, eip c02920f0, registers:
CPU:    1
EIP:    0060:[<c02920f0>]    Not tainted
EFLAGS: 00200086   (2.6.6-1-686-smp)
EIP is at .text.lock.sched+0x34/0xa4
eax: 00000000   ebx: f3106000   ecx: c1813be0   edx: f3106000
esi: f3c49edc   edi: 00200286   ebp: f3107ed0   esp: f3107ea4
ds: 007b   es: 007b   ss: 0068
Process Simulation_trac (pid: 2218, threadinfo=f3106000 task=f77ba0d0)
Stack: 00000000 f77ba0d0 c011bb60 f3c49ee0 f3c49ee0 c01b48c2 f3107f44 bf5ffa84
       f3106000 f3c49e48 f3106000 00200297 f8aafbcd f77f7a20 00000001 00000000
       f77ba0d0 c011bb60 00000000 00000000 f77515b8 f77ba5f4 f3107fc4 f3c49edc
Call Trace:
 [<c011bb60>] default_wake_function+0x0/0x20
 [<c01b48c2>] copy_from_user+0x42/0x70
 [<f8aafbcd>] video1394_ioctl+0xacd/0x1070 [video1394]
 [<c011bb60>] default_wake_function+0x0/0x20
 [<c010dc66>] convert_fxsr_from_user+0x26/0xf0
 [<c01e4f8e>] tty_write+0x19e/0x2f0
 [<c01eab80>] write_chan+0x0/0x230
 [<c015d7b7>] vfs_write+0x107/0x160
 [<c0171c08>] sys_ioctl+0x148/0x2d0
 [<c0102313>] huft_build+0x1d3/0x540
 [<c010621b>] syscall_call+0x7/0xb
 [<c0102313>] huft_build+0x1d3/0x540
                                                                               
                                                                               
                  
Code: 80 3e 00 7e f9 e9 9e fb ff ff f3 90 80 3e 00 7e f9 e9 11 fc
console shuts up ...

So it looks like someone did a WAIT/POLL BUFFER which sleeps without holding a
lock on d, and then someone did a UNLISTEN/UNTALK CHANNEL, which frees d...



                 reply	other threads:[~2004-05-22 15:11 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='7560000.1085238696@[10.10.2.4]' \
    --to=mbligh@aracnet.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®