ov511 [2.6.7-rc3] does something odd

usb 2-1.3: new full speed USB device using address 7
DEV: registering device: ID = '2-1.3'
PM: Adding info for usb:2-1.3
bus usb: add device 2-1.3
bound device '2-1.3' to driver 'usb'
DEV: registering device: ID = '2-1.3:1.0'
PM: Adding info for usb:2-1.3:1.0
bus usb: add device 2-1.3:1.0
drivers/usb/media/ov511.c: USB OV511 video device found drivers/usb/media/ov511.c: model: AverMedia InterCam Elite drivers/usb/media/ov511.c: Sensor is an OV7610
CLASS: registering class device: ID = 'video0'
class_hotplug - name = video0
drivers/usb/media/ov511.c: Device at usb-0000:00:10.0-1.3 registered to minor 0 bound device '2-1.3:1.0' to driver 'ov511'

stack segment: 0000 [1] PREEMPT
CPU 0
Modules linked in:
Pid: 6806, comm: camsource Not tainted 2.6.7-rc3
RIP: 0010:[<ffffffff803a9906>] <ffffffff803a9906>{ov51x_v4l1_ioctl+38}
RSP: 0018:000001003c4edf18  EFLAGS: 00010216
RAX: 000001003fefe920 RBX: 6b6b6b6b6b6b6c13 RCX: 00000000407ff760
RDX: 0000000040107613 RSI: 000001003a1d5a88 RDI: 6b6b6b6b6b6b6c13
RBP: 6b6b6b6b6b6b6b6b R08: 0000000000524f80 R09: 000001003d714c08
R10: 00000000407ff738 R11: 0000000000000246 R12: 00000000407ff760
R13: 0000000000000000 R14: 0000000000000007 R15: 00000000ffffffe7
FS:  00000000407ff960(005b) GS:ffffffff80737b00(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000002a9e5c8000 CR3: 0000000000101000 CR4: 00000000000006e0
Process camsource (pid: 6806, threadinfo 000001003c4ec000, task 000001003e1b2430)
Stack: 0000000040107613 0000000040107613 000001003a1d5a88 ffffffff801ad8bd
      0000000000000000 000000003b8658f4 0000000000000000 00000000005250c0
      00000000407ff760 0000000000525040
Call Trace:<ffffffff801ad8bd>{sys_ioctl+685} <ffffffff8011221a>{system_call+126}


Code: ff 8d a8 00 00 00 0f 88 8a 2c 00 00 31 c0 85 c0 41 b8 fc ff

RIP <ffffffff803a9906>{ov51x_v4l1_ioctl+38} RSP <000001003c4edf18>

begin:vcard
fn:David Ford
n:Ford;David
email;internet:[email protected]
title:Industrial Geek
tel;home:Ask please
tel;cell:(203) 650-3611
x-mozilla-html:TRUE
version:2.1
end:vcard

Interesting. I broke it in what looks like the same way on x86 last week..

Unable to handle kernel paging request at virtual address 6b6b6bff
 printing eip:
6306ba4d
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: ov511 videodev floppy uhci_hcd snd_pcm_oss loop snd_mixer_oss snd_emu10k1 snd_rawmidi snd_pcm snd_timer sndCPU:    3
EIP:    0060:[<6306ba4d>]    Not tainted
EFLAGS: 00010246   (2.6.6-1.381smp)

EIP is at ov51x_v4l1_ioctl+0x2c/0x75 [ov511]
eax: 00000000 ebx: 6b6b6bff ecx: 6b6b6bff edx: 00000091
esi: 6b6b6b6b edi: 367490f4 ebp: 40047612 esp: 05612f78
ds: 007b es: 007b ss: 0068
Process xawtv (pid: 14706, threadinfo=05612000 task=1f2eb3c0)

Stack: 43c6030c 63073820 40047612 367490f4 ffffffe7 0216dc88 08ade2d0 43c6030c
       05612000 0212ab53 00000000 00000000 00000000 00000000 05612fc4 08ade038
       08ade2d0 05612000 fffeb200 00000004 40047612 08ade2d0 08ade038 08ade2d0
Call Trace:
 [<0216dc88>] sys_ioctl+0x23d/0x2a0
 [<0212ab53>] sys_alarm+0x30/0x4e
                                                                                                                              
Code: f0 ff 8e 94 00 00 00 0f 88 18 21 00 00 31 c0 85 c0 ba fc ff

I started to look into it, but video_usercopy() gave me the creeps. OV511 could use a going over with sparse too. I'm not convinced about its handling of userspace pointers in its ioctl.

Dave