Re: Recurring Oops in link_path_walk()

[Scott Wood <scottwood@freescale.com>]

On Fri, 2015-11-20 at 17:56 +0000, Al Viro wrote:
> On Fri, Nov 20, 2015 at 06:07:59PM +0100, Christophe Leroy wrote:
> > Al,
> > 
> > We've been running Kernel 3.18 for several monthes on our embedded
> > boards, and we have a recurring Oops in link_path_walk()
> > It doesn't happen very often (approximatly once every month on one
> > board among a set of 50 boards, never the same board).
> > 
> > Here below is the last oops I got, with kernel 3.18.22. It crashes
> > at address 0xc00b75ac. Here below is the full desassembly of
> > link_path_walk() so that you can see exactly the offending line.
> > 
> > The address it fails at is always the same (link_path_walk+0x414)
> > but the oopsing data address is each time different. I added all
> > Oops I got below after the disassembly (on different sub-versions of
> > 3.18).
> 
> Looks like garbage in dentry->d_inode, assuming that reconstruction of
> the mapping of line numbers to addresses is correct...  Not sure it is,
> though; what's more, just how does LR manage to point to the insn right
> after the call of dput(), of all things?

When "bl dput" is executed, LR gets set to the instruction after the bl. 
 After dput returns, LR still has that value.  Presumably the call to mntput
was skipped via the beq.  Nothing else modifies LR between the dput return and
the faulting address.

-Scott