[alsa-devel] usb midi disconnect -> kernel oops

[Dmitry Baikov]

On 4/2/07, Takashi Iwai <tiwai at suse.de> wrote:
> > [  152.083000] Code: 58 8b 56 58 8b 41 04 89 42 04 89 10 c7 46 58 00
> > 01 10 00 eb 22 8d 6f 68 8d 5f 78 89 d8 e8 f0 ec 79 c7 8d 4e 50 8b 56
> > 50 8b 41 04 <89> 42 04 89 10 c7 46 50 00 01 10 00 c7 41 04 00 02 20 00
> > 89 d8
> > [  152.083000] EIP: [<f8997b00>] clear_subscriber_list+0xc7/0x11c
> > [snd_seq] SS:ESP 0068:c195dc5c
>
> Thanks.  I still don't get exactly where it happened.
> Could you run "objdump -Dl snd-seq.ko" and check the code around
> clear_subscriber_list match with the machine code above?

It is the middle of instruction at 4ad3, how can we get there?
Possibly, something added 2 to return address, instead of auto variable.

    4aa0:       e8 89 fd ff ff          call   482e <unsubscribe_port>
    4aa5:       85 ff                   test   %edi,%edi
    4aa7:       75 10                   jne    4ab9 <clear_subscriber_list+0x80>
    4aa9:       ff 4e 60                decl   0x60(%esi)
    4aac:       0f 94 c0                sete   %al
    4aaf:       84 c0                   test   %al,%al
    4ab1:       0f 84 82 00 00 00       je     4b39
<clear_subscriber_list+0x100>
    4ab7:       eb 79                   jmp    4b32 <clear_subscriber_list+0xf9>
    4ab9:       83 7c 24 30 00          cmpl   $0x0,0x30(%esp)
    4abe:       75 2a                   jne    4aea <clear_subscriber_list+0xb1>
    4ac0:       8d af b4 00 00 00       lea    0xb4(%edi),%ebp
    4ac6:       8d 9f c4 00 00 00       lea    0xc4(%edi),%ebx
    4acc:       89 d8                   mov    %ebx,%eax
    4ace:       e8 fc ff ff ff          call   4acf <clear_subscriber_list+0x96>
    4ad3:       8d 4e 58                lea    0x58(%esi),%ecx
    4ad6:       8b 56 58                mov    0x58(%esi),%edx
    4ad9:       8b 41 04                mov    0x4(%ecx),%eax
    4adc:       89 42 04                mov    %eax,0x4(%edx)
    4adf:       89 10                   mov    %edx,(%eax)
    4ae1:       c7 46 58 00 01 10 00    movl   $0x100100,0x58(%esi)
    4ae8:       eb 22                   jmp    4b0c <clear_subscriber_list+0xd3>
    4aea:       8d 6f 68                lea    0x68(%edi),%ebp
    4aed:       8d 5f 78                lea    0x78(%edi),%ebx
    4af0:       89 d8                   mov    %ebx,%eax
    4af2:       e8 fc ff ff ff          call   4af3 <clear_subscriber_list+0xba>