[lkml]   [2008]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Oops/Warning report for the week of March 28th 2008

    On Fri, 28 Mar 2008, Linus Torvalds wrote:
    > Is there something obvious that I'm missing? I'd really like to see the
    > whole posting that the oops came from. Do you save the originals or even
    > just message ID's from the ones you pick from emails?

    Hmm. Definitely not from the kernel mailing list. I'm intrigued, where did
    that oops #5814 come from (picked a recent one at random)?

    The thing is recent, and oopses on "mutex_lock(dev->mutex)" in
    input_release_device. In particular, the path *seems* to be this one:

    evdev_release ->
    evdev_ungrab ->
    input_release_device ->
    mutex_lock ->
    mutex_lock_nested ->
    __mutex_lock_common ->
    list_add_tail(&waiter.list, &lock->wait_list)

    where "lock->wait_list.prev" seems to be 0x6b6b6b6b6b6b6b6b, which is the
    use-after-free poison pattern.

    (In fact, I think the access that actually oopses is when the
    debug version of __list_add() does

    if (unlikely(prev->next != next)) {

    because that "prev" pointer is crap).

    So it seems that when input_release_device() does:

    struct input_dev *dev = handle->dev;


    the "dev" it uses has already been released. And this only shows up as a
    problem when you have slab debugging turned on (like the Fedora kernels
    do, thank you all Fedora guys).

    The odd thing is that I don't think any of this code has really changed


     \ /
      Last update: 2008-03-28 21:55    [W:0.020 / U:29.228 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site