Messages in this thread | | | Date | Mon, 16 Jul 2012 23:27:48 +0100 | From | Al Viro <> | Subject | Re: 3.5-rc6 dentry related GPF |
| |
On Mon, Jul 16, 2012 at 05:53:18PM -0400, Dave Jones wrote: > On Mon, Jul 16, 2012 at 10:32:18PM +0100, Al Viro wrote: > > On Wed, Jul 11, 2012 at 12:10:12PM -0700, Linus Torvalds wrote: > > > rdi = 54415541e5894855 > > > > > > which looks like some odd corrupted ASCII to me ("UH\211\345AUAT") but > > > that makes no sense either. > > > > It makes a lot of sense as amd64 code, though: > > > > 55 push %rbp > > 48 89 e5 mov %rsp,%rbp > > 41 55 push %r13 > > 41 54 push %r12 > > > > IOW, it's the first 8 bytes from a fairly sane beginning of some function. > > So &(inode->i_fop->owner) (and thus inode->i_fop - owner is the first field) > > is some spot in .text. Would be interesting to find out what function > > was that from (i.e. what's the value of inode->i_fop); with any luck it > > might've still been in some register. Could you post objdump of > > do_dentry_open() from your kernel? > > I've done a few rebuilds since posting that, but hopefully things haven't > moved around too much in that area recently.. > > http://fpaste.org/Pw5d/ is the whole open.o disassembly.
Lousy... mov 0x200(%r14),%rax // r14 == inode, rax = inode->i_fop test %rax,%rax // if (rax) je 1f // { mov (%rax),%rdi // rdi = rax->owner callq try_module_get // rax = try_module_get(rdi); 1f:
... and the value of inode->i_fop, which somehow has turned out to be the address of some function prologue, was only in rax. Clobbered by the point where try_module_get() has oopsed ;-/
Alas. Looks like all we are getting out of that one is that some function address has ended up in inode->i_fop...
| |