lkml.org 
[lkml]   [2003]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: 2.5.63 accesses below %esp (was: Re: ntfs OOPS (2.5.63))
    At 8:29pm -0800 3/13/03, Randy.Dunlap wrote:
    > > If you've got a symbol some reasonable distance before EIP, you could
    >> decode from there. I wrote a little code that does that (using
    >> kallsyms) very crudely in the stack trace in order to give the reader a
    >> hint about stack frames. Go to the prior symbol, which is usually an entry
    >> point, and find the %esp arithmetic. Works pretty well for figuring out the
    >> real call chain.
    >
    >as long as it's not a data symbol...
    >can you determine that?

    Sometimes/mostly, and btw my code is i386-only. The trace is question
    is arch/i386/kernel/traps.c:show_trace(). It already makes the test
    kernel_text_address(), which works in the kernel, but not for modules
    (at least in the kernel I'm using: 2.4.9 (don't ask)).

    For addresses in the trace (as opposed to the trapped EIP), I look
    for a call instruction preceding the putative return address. That's
    backwards assembly, but since there are relatively few possibilities,
    it seems to work fairly well.

    So finding a call is a good clue that we're looking at text. Look
    back from the call for argument pushes (I stop at the first non-push,
    because of the backwards-disassembly problem), then go to the
    previous symbol and scan forward for pushes and subtracts from %esp.
    The sum of all those, plus four bytes for the return link, gives me a
    lower limit on frame size. It's not perfect; a real disassembly
    forward from the symbol would maybe be better, but that seems like
    overkill (what to do with branches, etc).

    The idea isn't to be perfect anyway, but to give me hints for
    manually reconstructing the call chain. Way better than nothing.

    But for your purposes, disassembling from the previous symbol gives
    you a code dump, and you know that EIP had better be pointing to text.
    --
    /Jonathan Lundell.
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:33    [W:5.151 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site