Re: USB related "unable to handle kernel paging request" in 3.0.0-rc7

[Dan Carpenter]

Looking at this, I noticed a memory corruption bug introduce in:
ab22cbda6651d "[media] vp7045: get rid of on-stack dma buffers"

vp7045_properties.size_of_priv is sizeof(u8 *) so in vp7045_usb_probe()
the d->priv buffer gets allocated twice.  Once in:
	dvb_usb_device_init()
	-> dvb_usb_init()

And once explicitly to a larger buffer later on in the function with
a kmalloc().

So the two places that use the buffer will probably race and cause
memory corruption.

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/