Philippe Gerum wrote:
> Andreas Glatz wrote:
>> Hi,
>>
>> I got a kernel crash because inside xnheap_test_and_free a 
>> invalid pointer contained in variable 'nextpage' is dereferenced:
>>
> 
> <snip>
> 
> This turned out to be caused by an out-of-bound write triggered by the 
> streaming 
> output service.
> 
> The patch below fixes the issue; it has been committed to both the 
> maintenance 
> (v2.4.x) and development branches.
> 
> Sidenote: your test scenario involves echoing some data to /dev/rtp0 for 
> triggering the issue; this will now work, but you won't get that input 
> available 
> to rt_pipe_read(). In case you wonder why, the reason is that 'echo' will 
> exit 
> immediately after sending the bytes, which will cause the user-space side of 
> the 
> channel to be closed, and the input queue (the one that goes user -> kernel) 
> to 
> be flushed from any pending data.
> 

...unless your polling RT read loop wakes up at the right time and manages to 
preempt the Linux kernel shortly after the echo sent the bytes, in which case 
you will receive the data, but that is obviously not the most frequent 
situation.

-- 
Philippe.

_______________________________________________
Xenomai-core mailing list
Xenomai-core@gna.org
https://mail.gna.org/listinfo/xenomai-core

Reply via email to