Messages in this thread |  | | | Subject | Re: [PATCH] tty: add lockdep annotations | | From | Eric Dumazet <> | | Date | Fri, 01 Jun 2012 22:59:49 +0200 |
| |
On Fri, 2012-06-01 at 21:56 +0100, Alan Cox wrote: > > Yes, tty->driver deref is ok (tty points to valid memory), but crash is > > on tty->driver->ops (driver points to freed/illegal memory) > > > > using slub_debug=FZPU, I can indeed see RDI=6b6b6b6b6b6b6b6b > > driver and driver->ops is basically const and it's not what you'd expect > from a tty refcount bug. The driver side puts shouldn't have changed but > I'll take a look over that patch and the error paths closely again just > in case.
right
The code looks like : ... call mcount mov %rdi,%rbx mov 0x10(%rdi),%rdi tty->driver <> mov 0xf8(%rdi),%rax CRASH
So tty was freed an tty->driver contains 6b6b6b6b6b6b6b6b
|  |