2004-10-30 13:49:55

by Eyal Lebedinsky

[permalink] [raw]
Subject: 2.6.10-rc1 bttv oops in btcx_riscmem_free

Watching on Mythtv, I stopped watching on the client. at this point
the picture froze. Looking in dmesg I see this oops. The machine
quicly becomes unusable ('ps aux' hangs).

I then applied the v4l patches off the list. Still the same problem.

Unable to handle kernel paging request at virtual address 85525fe9
printing eip:
c010b567
*pde = 00000000
Oops: 0000 [#1]
PREEMPT SMP
Modules linked in: nls_iso8859_1 smbfs tsdev psmouse mt352 sp887x v4l1_compat dvb_bt8xx dvb_core i810_audio ac97_codec sr_mod sg ide_scsi ide_cd cdrom it87 eeprom i2c_isa i2c_i801 i2c_sensor eth1394 ohci_hcd ohci1394 ieee1394 dc395x scsi_mod snd_bt87x bt878 bttv tuner video_buf firmware_class i2c_algo_bit v4l2_common btcx_risc videodev e1000 snd_intel8x0 snd_ac97_codec snd_pcm snd_timer snd_page_alloc gameport snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore i2c_core cfi_cmdset_0002 cfi_util mtdpart jedec_probe cfi_probe gen_probe ichxrom mtdcore chipreg map_funcs ehci_hcd uhci_hcd usbcore shpchp pciehp pci_hotplug intel_mch_agp intel_agp agpgart parport_pc parport 8250_pnp 8250 serial_core evdev nls_cp437 msdos fat dm_mod rtc unix
CPU: 0
EIP: 0060:[<c010b567>] Not tainted VLI
EFLAGS: 00210282 (2.6.10-rc1-d1)
EIP is at dma_free_coherent+0x30/0x67
eax: 00000000 ebx: e3f9e000 ecx: e3f9e000 edx: 00000001
esi: 85525fe9 edi: eae38438 ebp: d86ec8ac esp: e0c2fedc
ds: 007b es: 007b ss: 0068
Process mythbackend (pid: 15225, threadinfo=e0c2f000 task=f3290a20)
Stack: e7f36b80 eae38380 f8f9d03d e7f36bc4 00001f18 e3f9e000 23f9e000 eae383a4
d8931e80 f9091bdd e7f36b80 eae38438 00000000 00000000 f5034ca0 d86ec8ac
f9020ba9 d8931e80 eae38380 00000000 c180f400 e6d09e94 e6d09e94 e6d09ebc
Call Trace:
[<f8f9d03d>] btcx_riscmem_free+0x3d/0x84 [btcx_risc]
[<f9091bdd>] bttv_dma_free+0x74/0x9f [bttv]
[<f9020ba9>] videobuf_vm_close+0x97/0xc9 [video_buf]
[<c014b593>] remove_vm_struct+0x91/0x93
[<c014cd7f>] unmap_vma_list+0x1c/0x28
[<c014d145>] do_munmap+0x14d/0x19e
[<c014d1e7>] sys_munmap+0x51/0x76
[<c010508b>] syscall_call+0x7/0xb
Code: 44 24 0c 8b 54 24 10 8b 5c 24 14 85 c0 74 06 8b b0 b8 00 00 00 8d 42 ff ba ff ff ff ff c1 e8 0b 83 c2 01 d1 e8 75 f9 85 f6 74 13 <8b> 0e 39 cb 72 0d 8b 46 08 c1 e0 0c 8d 04 08 39 c3 72 09 89 d8

--
Eyal Lebedinsky ([email protected]) <http://samba.org/eyal/>


2004-10-30 17:22:05

by Peter Osterlund

[permalink] [raw]
Subject: Re: 2.6.10-rc1 bttv oops in btcx_riscmem_free

Eyal Lebedinsky <[email protected]> writes:

> Watching on Mythtv, I stopped watching on the client. at this point
> the picture froze. Looking in dmesg I see this oops. The machine
> quicly becomes unusable ('ps aux' hangs).
>
> I then applied the v4l patches off the list. Still the same problem.
>
> Unable to handle kernel paging request at virtual address 85525fe9

I have similar problems using 2.6.10-rc1-bk8. Often when I exit
tvtime, I get "unable to handle kernel paging request" or "unable to
handle kernel NULL pointer", see below.

The previous kernel I used on this machine was 2.6.9-rc3-bk9, which
does not have this problem.

I can do a binary search to figure out when it broke if you think it
will help.


Oct 30 14:12:55 p4 kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000011
Oct 30 14:12:55 p4 kernel: printing eip:
Oct 30 14:12:55 p4 kernel: c010a237
Oct 30 14:12:55 p4 kernel: *pde = 00000000
Oct 30 14:12:55 p4 kernel: Oops: 0000 [#1]
Oct 30 14:12:55 p4 kernel: PREEMPT
Oct 30 14:12:55 p4 kernel: Modules linked in: snd_pcm_oss tuner tda9887 msp3400 bttv video_buf firmware_class v4l2_common btcx_risc videodev snd_mixer_oss snd_emu10k1 snd_rawmidi snd_ac97_codec snd_pcm snd_timer snd_page_alloc snd_util_mem snd_hwdep snd soundcore radeon nfsd exportfs lockd parport_pc lp parport autofs4 sunrpc ipt_MASQUERADE iptable_nat ipt_LOG ipt_limit ipt_state ipt_REJECT iptable_filter ip_tables sd_mod dm_mod usb_storage uhci_hcd ehci_hcd rtc
Oct 30 14:12:55 p4 kernel: CPU: 0
Oct 30 14:12:55 p4 kernel: EIP: 0060:[<c010a237>] Not tainted VLI
Oct 30 14:12:55 p4 kernel: EFLAGS: 00210206 (2.6.10-rc1-bk8)
Oct 30 14:12:55 p4 kernel: EIP is at dma_free_coherent+0x30/0x67
Oct 30 14:12:55 p4 kernel: eax: 00000000 ebx: e429d000 ecx: e429d000 edx: 00000000
Oct 30 14:12:55 p4 kernel: esi: 00000011 edi: e3a14f34 ebp: eac6a800 esp: de55bee4
Oct 30 14:12:55 p4 kernel: ds: 007b es: 007b ss: 0068
Oct 30 14:12:55 p4 kernel: Process tvtime (pid: 5018, threadinfo=de55a000 task=e19ac580)
Oct 30 14:12:55 p4 kernel: Stack: e7b3d680 e3a14e80 f8a3203d e7b3d6c4 00000c38 e429d000 2429d000 e3a14ea4
Oct 30 14:12:55 p4 kernel: e7b3d880 f8d2fb35 e7b3d680 e3a14f34 00000000 00000000 e79e7720 ee3744bc
Oct 30 14:12:55 p4 kernel: f8afbc55 e7b3d880 e3a14e80 00035000 eac6a800 de55a000 de55a000 e7861c80
Oct 30 14:12:55 p4 kernel: Call Trace:
Oct 30 14:12:55 p4 kernel: [<f8a3203d>] btcx_riscmem_free+0x3d/0x84 [btcx_risc]
Oct 30 14:12:55 p4 kernel: [<f8d2fb35>] bttv_dma_free+0x74/0x9f [bttv]
Oct 30 14:12:55 p4 kernel: [<f8afbc55>] videobuf_vm_close+0x97/0xc9 [video_buf]
Oct 30 14:12:55 p4 kernel: [<c014348b>] remove_vm_struct+0x8e/0x97
Oct 30 14:12:55 p4 kernel: [<c0144c85>] unmap_vma_list+0x1c/0x28
Oct 30 14:12:55 p4 kernel: [<c0145008>] do_munmap+0x142/0x17f
Oct 30 14:12:55 p4 kernel: [<c0145089>] sys_munmap+0x44/0x64
Oct 30 14:12:55 p4 kernel: [<c0103fbd>] sysenter_past_esp+0x52/0x71
Oct 30 14:12:55 p4 kernel: Code: 44 24 0c 8b 54 24 10 8b 5c 24 14 85 c0 74 06 8b b0 b8 00 00 00 8d 42 ff ba ff ff ff ff c1 e8 0b 83 c2 01 d1 e8 75 f9 85 f6 74 13 <8b> 0e 39 cb 72 0d 8b 46 08 c1 e0 0c 8d 04 08 39 c3 72 09 89 d8

--
Peter Osterlund - [email protected]
http://w1.894.telia.com/~u89404340

2004-10-31 15:01:33

by Peter Osterlund

[permalink] [raw]
Subject: Re: 2.6.10-rc1 bttv oops in btcx_riscmem_free

Peter Osterlund <[email protected]> writes:

> Eyal Lebedinsky <[email protected]> writes:
>
> > Watching on Mythtv, I stopped watching on the client. at this point
> > the picture froze. Looking in dmesg I see this oops. The machine
> > quicly becomes unusable ('ps aux' hangs).
> >
> > I then applied the v4l patches off the list. Still the same problem.
> >
> > Unable to handle kernel paging request at virtual address 85525fe9
>
> I have similar problems using 2.6.10-rc1-bk8. Often when I exit
> tvtime, I get "unable to handle kernel paging request" or "unable to
> handle kernel NULL pointer", see below.
>
> The previous kernel I used on this machine was 2.6.9-rc3-bk9, which
> does not have this problem.

I've found that I can't trigger the oops if I revert these two patches:

http://linus.bkbits.net:8080/linux-2.5/cset@417681b1ZY5TxMjPnGdT0mbmUVn_Aw?nav=index.html|ChangeSet@-2w
http://linus.bkbits.net:8080/linux-2.5/cset@41768196E6i6bbiUnhTg9OFubLPWHA?nav=index.html|ChangeSet@-2w


> Oct 30 14:12:55 p4 kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000011
> Oct 30 14:12:55 p4 kernel: printing eip:
> Oct 30 14:12:55 p4 kernel: c010a237
> Oct 30 14:12:55 p4 kernel: *pde = 00000000
> Oct 30 14:12:55 p4 kernel: Oops: 0000 [#1]
> Oct 30 14:12:55 p4 kernel: PREEMPT
> Oct 30 14:12:55 p4 kernel: Modules linked in: snd_pcm_oss tuner tda9887 msp3400 bttv video_buf firmware_class v4l2_common btcx_risc videodev snd_mixer_oss snd_emu10k1 snd_rawmidi snd_ac97_codec snd_pcm snd_timer snd_page_alloc snd_util_mem snd_hwdep snd soundcore radeon nfsd exportfs lockd parport_pc lp parport autofs4 sunrpc ipt_MASQUERADE iptable_nat ipt_LOG ipt_limit ipt_state ipt_REJECT iptable_filter ip_tables sd_mod dm_mod usb_storage uhci_hcd ehci_hcd rtc
> Oct 30 14:12:55 p4 kernel: CPU: 0
> Oct 30 14:12:55 p4 kernel: EIP: 0060:[<c010a237>] Not tainted VLI
> Oct 30 14:12:55 p4 kernel: EFLAGS: 00210206 (2.6.10-rc1-bk8)
> Oct 30 14:12:55 p4 kernel: EIP is at dma_free_coherent+0x30/0x67
> Oct 30 14:12:55 p4 kernel: eax: 00000000 ebx: e429d000 ecx: e429d000 edx: 00000000
> Oct 30 14:12:55 p4 kernel: esi: 00000011 edi: e3a14f34 ebp: eac6a800 esp: de55bee4
> Oct 30 14:12:55 p4 kernel: ds: 007b es: 007b ss: 0068
> Oct 30 14:12:55 p4 kernel: Process tvtime (pid: 5018, threadinfo=de55a000 task=e19ac580)
> Oct 30 14:12:55 p4 kernel: Stack: e7b3d680 e3a14e80 f8a3203d e7b3d6c4 00000c38 e429d000 2429d000 e3a14ea4
> Oct 30 14:12:55 p4 kernel: e7b3d880 f8d2fb35 e7b3d680 e3a14f34 00000000 00000000 e79e7720 ee3744bc
> Oct 30 14:12:55 p4 kernel: f8afbc55 e7b3d880 e3a14e80 00035000 eac6a800 de55a000 de55a000 e7861c80
> Oct 30 14:12:55 p4 kernel: Call Trace:
> Oct 30 14:12:55 p4 kernel: [<f8a3203d>] btcx_riscmem_free+0x3d/0x84 [btcx_risc]
> Oct 30 14:12:55 p4 kernel: [<f8d2fb35>] bttv_dma_free+0x74/0x9f [bttv]
> Oct 30 14:12:55 p4 kernel: [<f8afbc55>] videobuf_vm_close+0x97/0xc9 [video_buf]
> Oct 30 14:12:55 p4 kernel: [<c014348b>] remove_vm_struct+0x8e/0x97
> Oct 30 14:12:55 p4 kernel: [<c0144c85>] unmap_vma_list+0x1c/0x28
> Oct 30 14:12:55 p4 kernel: [<c0145008>] do_munmap+0x142/0x17f
> Oct 30 14:12:55 p4 kernel: [<c0145089>] sys_munmap+0x44/0x64
> Oct 30 14:12:55 p4 kernel: [<c0103fbd>] sysenter_past_esp+0x52/0x71
> Oct 30 14:12:55 p4 kernel: Code: 44 24 0c 8b 54 24 10 8b 5c 24 14 85 c0 74 06 8b b0 b8 00 00 00 8d 42 ff ba ff ff ff ff c1 e8 0b 83 c2 01 d1 e8 75 f9 85 f6 74 13 <8b> 0e 39 cb 72 0d 8b 46 08 c1 e0 0c 8d 04 08 39 c3 72 09 89 d8

--
Peter Osterlund - [email protected]
http://w1.894.telia.com/~u89404340

2004-11-04 11:57:41

by Gerd Knorr

[permalink] [raw]
Subject: Re: 2.6.10-rc1 bttv oops in btcx_riscmem_free

> I have similar problems using 2.6.10-rc1-bk8. Often when I exit
> tvtime, I get "unable to handle kernel paging request" or "unable to
> handle kernel NULL pointer", see below.

Any more hints how to trigger that? I can't reproduce that on my
machines, neither with xawtv nor tvtime.

Any change when setting the triton=1 or vsfx=1 insmod options (probably
not, but who knows ...)?

> Oct 30 14:12:55 p4 kernel: Call Trace:
> Oct 30 14:12:55 p4 kernel: [<f8a3203d>] btcx_riscmem_free+0x3d/0x84 [btcx_risc]
> Oct 30 14:12:55 p4 kernel: [<f8d2fb35>] bttv_dma_free+0x74/0x9f [bttv]

Hmm, I somehow miss either buffer_release or vbi_buffer_release here.
Do you have KALLSYMS enabled? Does tvtime use video only or vbi as
well?

Can you try to enable debug=1 for the video-buf module?

Gerd

--
#define printk(args...) fprintf(stderr, ## args)

2004-11-04 20:31:17

by Peter Osterlund

[permalink] [raw]
Subject: Re: 2.6.10-rc1 bttv oops in btcx_riscmem_free

Gerd Knorr <[email protected]> writes:

> > I have similar problems using 2.6.10-rc1-bk8. Often when I exit
> > tvtime, I get "unable to handle kernel paging request" or "unable to
> > handle kernel NULL pointer", see below.
>
> Any more hints how to trigger that? I can't reproduce that on my
> machines, neither with xawtv nor tvtime.

If I run

while true ; do tvtime ; done

and hit 'q' repeatedly to stop tvtime, I always get the oops sooner or
later. Usually <= 10 iterations are needed, but not always. It appears
to be a race condition.

> Any change when setting the triton=1 or vsfx=1 insmod options (probably
> not, but who knows ...)?

I tried triton1=1 and vsfx=1, but I still get the oops.

> > Oct 30 14:12:55 p4 kernel: Call Trace:
> > Oct 30 14:12:55 p4 kernel: [<f8a3203d>] btcx_riscmem_free+0x3d/0x84 [btcx_risc]
> > Oct 30 14:12:55 p4 kernel: [<f8d2fb35>] bttv_dma_free+0x74/0x9f [bttv]
>
> Hmm, I somehow miss either buffer_release or vbi_buffer_release here.
> Do you have KALLSYMS enabled? Does tvtime use video only or vbi as
> well?

Yes I have KALLSYMS enabled. I don't know why the backtrace is
incomplete, but I added printk's and saw that it's buffer_release()
that calls bttv_dma_free(). According to strace, tvtime doesn't open
any /dev/vbi* device.

> Can you try to enable debug=1 for the video-buf module?

vbuf: reqbufs: bufs=4, size=0xcb000 [812 pages total]
vbuf: mmap setup: 4 buffers, 831488 bytes each
vbuf: mmap eab9d520: b7cac000-b7d77000 pgoff 00000000 bufs 0-0
vbuf: mmap f10449e0: b7be1000-b7cac000 pgoff 000000cb bufs 1-1
vbuf: mmap f10443e0: b7b16000-b7be1000 pgoff 00000196 bufs 2-2
vbuf: mmap f1044c40: b7a4b000-b7b16000 pgoff 00000261 bufs 3-3
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: munmap eab9d520
vbuf: munmap f10449e0
vbuf: munmap f10443e0
vbuf: munmap f1044c40
vbuf: reqbufs: bufs=4, size=0xcb000 [812 pages total]
vbuf: mmap setup: 4 buffers, 831488 bytes each
vbuf: mmap f1044c40: b7cac000-b7d77000 pgoff 00000000 bufs 0-0
vbuf: mmap f10443e0: b7be1000-b7cac000 pgoff 000000cb bufs 1-1
vbuf: mmap f10449e0: b7b16000-b7be1000 pgoff 00000196 bufs 2-2
vbuf: mmap eab9d520: b7a4b000-b7b16000 pgoff 00000261 bufs 3-3
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: munmap f1044c40
vbuf: munmap f10443e0
vbuf: munmap f10449e0
vbuf: munmap eab9d520
vbuf: reqbufs: bufs=4, size=0xcb000 [812 pages total]
vbuf: mmap setup: 4 buffers, 831488 bytes each
vbuf: mmap eab9d520: b7cac000-b7d77000 pgoff 00000000 bufs 0-0
vbuf: mmap f10449e0: b7be1000-b7cac000 pgoff 000000cb bufs 1-1
vbuf: mmap f10443e0: b7b16000-b7be1000 pgoff 00000196 bufs 2-2
vbuf: mmap f1044c40: b7a4b000-b7b16000 pgoff 00000261 bufs 3-3
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: init user [0xb7cac000+0xcb000 => 203 pages]
vbuf: init user [0xb7be1000+0xcb000 => 203 pages]
vbuf: init user [0xb7b16000+0xcb000 => 203 pages]
vbuf: init user [0xb7a4b000+0xcb000 => 203 pages]
vbuf: munmap eab9d520
Unable to handle kernel paging request at virtual address 00ffffff
printing eip:
c010a237
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: bttv video_buf tuner tda9887 msp3400 firmware_class v4l2_common btcx_risc videodev snd_mixer_oss snd_emu10k1 snd_rawmidi snd_ac97_codec snd_pcm snd_timer snd_page_alloc snd_util_mem snd_hwdep snd soundcore radeon nfsd exportfs lockd parport_pc lp parport autofs4 sunrpc ipt_MASQUERADE iptable_nat ipt_LOG ipt_limit ipt_state ipt_REJECT iptable_filter ip_tables dm_mod sd_mod usb_storage uhci_hcd ehci_hcd rtc
CPU: 0
EIP: 0060:[<c010a237>] Not tainted VLI
EFLAGS: 00210206 (2.6.10-rc1-bk8)
EIP is at dma_free_coherent+0x30/0x67
eax: 00000000 ebx: e9ca5000 ecx: e9ca5000 edx: 00000000
esi: 00ffffff edi: e6e30c34 ebp: eb7fb080 esp: e9db5ee4
ds: 007b es: 007b ss: 0068
Process tvtime (pid: 4992, threadinfo=e9db4000 task=e8d96a60)
Stack: ea990680 e6e30b80 f8a3203d ea9906c4 00000c38 e9ca5000 29ca5000 e6e30ba4
eaaacb80 f8d3ab35 ea990680 e6e30c34 00000000 00000000 eab9d520 ee3c84bc
f8afbc55 eaaacb80 e6e30b80 00035000 eb7fb080 e9db4000 e9db4000 eaaac980
Call Trace:
[<f8a3203d>] btcx_riscmem_free+0x3d/0x84 [btcx_risc]
[<f8d3ab35>] bttv_dma_free+0x74/0x9f [bttv]
[<f8afbc55>] videobuf_vm_close+0x97/0xc9 [video_buf]
[<c014348b>] remove_vm_struct+0x8e/0x97
[<c0144c85>] unmap_vma_list+0x1c/0x28
[<c0145008>] do_munmap+0x142/0x17f
[<c0145089>] sys_munmap+0x44/0x64
[<c010400f>] syscall_call+0x7/0xb
Code: 44 24 0c 8b 54 24 10 8b 5c 24 14 85 c0 74 06 8b b0 b8 00 00 00 8d 42 ff ba ff ff ff ff c1 e8 0b 83 c2 01 d1 e8 75 f9 85 f6 74 13 <8b> 0e 39 cb 72 0d 8b 46 08 c1 e0 0c 8d 04 08 39 c3 72 09 89 d8

--
Peter Osterlund - [email protected]
http://w1.894.telia.com/~u89404340

2004-11-06 23:17:15

by Peter Osterlund

[permalink] [raw]
Subject: Re: 2.6.10-rc1 bttv oops in btcx_riscmem_free

Peter Osterlund <[email protected]> writes:

> Eyal Lebedinsky <[email protected]> writes:
>
> > Watching on Mythtv, I stopped watching on the client. at this point
> > the picture froze. Looking in dmesg I see this oops. The machine
> > quicly becomes unusable ('ps aux' hangs).
> >
> > I then applied the v4l patches off the list. Still the same problem.
> >
> > Unable to handle kernel paging request at virtual address 85525fe9
>
> I have similar problems using 2.6.10-rc1-bk8. Often when I exit
> tvtime, I get "unable to handle kernel paging request" or "unable to
> handle kernel NULL pointer", see below.

I found the bug. Here is a patch to fix it.

Signed-off-by: Peter Osterlund <[email protected]>
---

linux-petero/drivers/media/video/video-buf.c | 2 +-
1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN drivers/media/video/video-buf.c~bttv-fix3 drivers/media/video/video-buf.c
--- linux/drivers/media/video/video-buf.c~bttv-fix3 2004-11-07 00:10:04.632421064 +0100
+++ linux-petero/drivers/media/video/video-buf.c 2004-11-07 00:10:04.635420608 +0100
@@ -1063,7 +1063,7 @@ videobuf_vm_close(struct vm_area_struct
continue;
map->q->bufs[i]->map = NULL;
map->q->bufs[i]->baddr = 0;
- map->q->ops->buf_release(vma->vm_file,map->q->bufs[i]);
+ map->q->ops->buf_release(vma->vm_file->private_data,map->q->bufs[i]);
}
kfree(map);
}
_

--
Peter Osterlund - [email protected]
http://w1.894.telia.com/~u89404340