At Tue, 3 Apr 2007 00:03:31 +0400, Dmitry Baikov wrote:
On 4/2/07, Takashi Iwai tiwai@suse.de wrote:
[ 152.083000] Code: 58 8b 56 58 8b 41 04 89 42 04 89 10 c7 46 58 00 01 10 00 eb 22 8d 6f 68 8d 5f 78 89 d8 e8 f0 ec 79 c7 8d 4e 50 8b 56 50 8b 41 04 <89> 42 04 89 10 c7 46 50 00 01 10 00 c7 41 04 00 02 20 00 89 d8 [ 152.083000] EIP: [<f8997b00>] clear_subscriber_list+0xc7/0x11c [snd_seq] SS:ESP 0068:c195dc5c
Thanks. I still don't get exactly where it happened. Could you run "objdump -Dl snd-seq.ko" and check the code around clear_subscriber_list match with the machine code above?
It is the middle of instruction at 4ad3, how can we get there?
I guess you're looking at a different place. As you can find the place matching with "89" (marked in the middle) somewhere in clear_subscriber_list(). Check the byte matter matching with disassembler code. Also, you can get source code lines via -l option of objdump, which helps pretty much.
Takashi
Possibly, something added 2 to return address, instead of auto variable.
4aa0: e8 89 fd ff ff call 482e <unsubscribe_port> 4aa5: 85 ff test %edi,%edi 4aa7: 75 10 jne 4ab9 <clear_subscriber_list+0x80> 4aa9: ff 4e 60 decl 0x60(%esi) 4aac: 0f 94 c0 sete %al 4aaf: 84 c0 test %al,%al 4ab1: 0f 84 82 00 00 00 je 4b39<clear_subscriber_list+0x100> 4ab7: eb 79 jmp 4b32 <clear_subscriber_list+0xf9> 4ab9: 83 7c 24 30 00 cmpl $0x0,0x30(%esp) 4abe: 75 2a jne 4aea <clear_subscriber_list+0xb1> 4ac0: 8d af b4 00 00 00 lea 0xb4(%edi),%ebp 4ac6: 8d 9f c4 00 00 00 lea 0xc4(%edi),%ebx 4acc: 89 d8 mov %ebx,%eax 4ace: e8 fc ff ff ff call 4acf <clear_subscriber_list+0x96> 4ad3: 8d 4e 58 lea 0x58(%esi),%ecx 4ad6: 8b 56 58 mov 0x58(%esi),%edx 4ad9: 8b 41 04 mov 0x4(%ecx),%eax 4adc: 89 42 04 mov %eax,0x4(%edx) 4adf: 89 10 mov %edx,(%eax) 4ae1: c7 46 58 00 01 10 00 movl $0x100100,0x58(%esi) 4ae8: eb 22 jmp 4b0c <clear_subscriber_list+0xd3> 4aea: 8d 6f 68 lea 0x68(%edi),%ebp 4aed: 8d 5f 78 lea 0x78(%edi),%ebx 4af0: 89 d8 mov %ebx,%eax 4af2: e8 fc ff ff ff call 4af3 <clear_subscriber_list+0xba>