Messages in this thread | | | Date | Tue, 5 Nov 2002 10:20:55 +0000 | From | Russell King <> | Subject | Re: 2.5.45 odd deref in serial_in |
| |
On Mon, Nov 04, 2002 at 11:27:28PM -0500, Zwane Mwaikambo wrote: > 0xc023b428 <serial_in+24>: je 0xc023b461 <serial_in+81> > 0xc023b42a <serial_in+26>: cmp $0x2,%eax > 0xc023b42d <serial_in+29>: je 0xc023b440 <serial_in+48> > 0xc023b42f <serial_in+31>: mov 0x8(%ebx),%eax > 0xc023b432 <serial_in+34>: add %eax,%edx > 0xc023b434 <serial_in+36>: in (%dx),%al > > eax: 00000000 ebx: 81acc5f0 ecx: 00000000 edx: 00000005 > > ... > default: > return inb(up->port.iobase + offset); <-- > }
Ok, if I'm reading this correctly:
offset = %edx up->port.iobase = 0x8(%ebx) up = %ebx
To get to this return statement, we would have had to execute:
static _INLINE_ unsigned int serial_in(struct uart_8250_port *up, int offset) { offset <<= up->port.regshift;
switch (up->port.iotype) {
which also dereferences "up". So something may have corrupted %ebx between executing that switch statement and executing the inb().
Could the NMI handler be corrupting %ebx ?
-- Russell King (rmk@arm.linux.org.uk) The developer of ARM Linux http://www.arm.linux.org.uk/personal/aboutme.html
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |