Messages in this thread | | | Date | Fri, 26 Jun 2009 08:39:19 +0100 | From | Al Viro <> | Subject | Re: 2.6.31-rc1 crashes randomly on my Machine. |
| |
On Fri, Jun 26, 2009 at 08:15:21AM +0100, Al Viro wrote: > On Fri, Jun 26, 2009 at 08:56:52AM +0200, Zeno Davatz wrote: > > > Jun 25 21:19:12 zenogentoo Code: 00 00 00 c7 47 20 00 00 00 00 c7 47 > > 24 00 00 00 00 c7 47 10 00 00 00 00 c7 47 14 00 00 00 00 c7 47 0c 00 > > 00 00 00 e9 27 ff ff ff <ff> 89 e5 57 56 53 83 ec 34 89 45 d0 89 55 cc > > 89 4d c8 8b 70 6c > > Jun 25 21:19:12 zenogentoo EIP: [<c10d1d35>] seq_read+0x0/0x3a5 SS:ESP > > 0068:f4b01f44 > > Jun 25 21:19:12 zenogentoo CR2: 0000000053565be5 > > Jun 25 21:19:12 zenogentoo ---[ end trace 6254fef9dc80950b ]--- > > Jun 25 21:19:12 zenogentoo BUG: unable to handle kernel paging request > > at 53565be5 > > Real cute... Disassembly of that sucker: > decl 0x535657e5(%ecx) > which matches nicely the address in page fault. However, that doesn't > look even remotely plausible for a beginning of function. OTOH, > disassembly at one byte offset from that gives > mov %esp,%ebp > push %edi > push %esi > push %ebx > which is exactly what you'd expect to see in such place.
Actually, it's not *quite* what you'd expect to see. What's missing is push %ebp as the first instruction, preceding that stuff. And it would take one byte, so...
> IOW, you've > got an off-by-one - it had jumped at one byte before the actual entry > point of seq_read().
... this is not an off-by-one at all. The first byte of function code got overwritten with 0xff. Code before that doesn't seem to be mangled - it's movl $0x0,0x20(%edi) movl $0x0,0x24(%edi) movl $0x0,0x10(%edi) movl $0x0,0x14(%edi) movl $0x0,0xc(%edi) jmp <a bit back> which is at least not entirely implausible. So it seems to be a memory corruption in .text, which might or might not affect the directly preceding bytes (0xe9 <signed 32bit int> is a relative jump, so there's no way to tell whether this 0xff had been the only byte affected - it would be preceded by 3 0xff coming from small negative integer anyway).
| |