linux-kernel - Re: tracing ring_buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1337910106.13348.234.camel@gandalf.stny.rr.com>
Date:	Thu, 24 May 2012 21:41:46 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	"H. Peter Anvin" <hpa@...ux.intel.com>
Cc:	Dave Jones <davej@...hat.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Ingo Molnar <mingo@...hat.com>, Andi Kleen <ak@...ux.intel.com>
Subject: Re: tracing ring_buffer_resize oops.

On Thu, 2012-05-24 at 21:39 -0400, Steven Rostedt wrote:

> >   Specifically, note that the value of R12 is the same
> > value; R12 is a preserved register and may have been pushed onto the
> > stack by something that wants to save it.
> 
> I don't see R12 as the same value:
> 
> RIP: <ffff88014630a000>
> GS: ffff880148000000
> R12: ffff880145cc0000
> 
> Close but not quite. Even R13 and R15 are close:
> 
> R13: ffff880148008eb8
> R15: ffff88014780cb40
> 
> But this probably does show that the stack is screwed up and did a bad
> iret.
> 

Here's the stack of the first time I saw this crash:

RIP: 92dc:[<ffff88007dc042a0>]  [<ffff88007dc042a0>] 0xffff88007dc0429f
RSP: 0018:0000000000000576  EFLAGS: 00000575
RAX: 0000000000000001 RBX: ffffffff812b4e6e RCX: ffff88007e209e00
RDX: 0000000000005495 RSI: ffffffff826165b0 RDI: ffff88007e209eb8
RBP: ffff88007e209ed8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff880078d6fa00 R11: ffff880078d6fa00 R12: ffff880078c3dfa0
R13: ffffffff810b92dc R14: 00000000000000e6 R15: 00000000000000e8
FS:  0000000000000000(0000) GS:ffff88007e200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff88007dc042a0 CR3: 0000000069ec4000 CR4: 00000000000007f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400

RCX, RDI, RBP, R10, R11, and R12 are all like GS and RIP.

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/