lkml.org 
[lkml]   [2002]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: 2.5.45 odd deref in serial_in
    On Mon, Nov 04, 2002 at 11:27:28PM -0500, Zwane Mwaikambo wrote:
    > 0xc023b428 <serial_in+24>: je 0xc023b461 <serial_in+81>
    > 0xc023b42a <serial_in+26>: cmp $0x2,%eax
    > 0xc023b42d <serial_in+29>: je 0xc023b440 <serial_in+48>
    > 0xc023b42f <serial_in+31>: mov 0x8(%ebx),%eax
    > 0xc023b432 <serial_in+34>: add %eax,%edx
    > 0xc023b434 <serial_in+36>: in (%dx),%al
    >
    > eax: 00000000 ebx: 81acc5f0 ecx: 00000000 edx: 00000005
    >
    > ...
    > default:
    > return inb(up->port.iobase + offset); <--
    > }

    Ok, if I'm reading this correctly:

    offset = %edx
    up->port.iobase = 0x8(%ebx)
    up = %ebx

    To get to this return statement, we would have had to execute:

    static _INLINE_ unsigned int serial_in(struct uart_8250_port *up, int offset)
    {
    offset <<= up->port.regshift;

    switch (up->port.iotype) {

    which also dereferences "up". So something may have corrupted %ebx
    between executing that switch statement and executing the inb().

    Could the NMI handler be corrupting %ebx ?

    --
    Russell King (rmk@arm.linux.org.uk) The developer of ARM Linux
    http://www.arm.linux.org.uk/personal/aboutme.html

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:30    [W:0.020 / U:2.300 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site