From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from zeniv.linux.org.uk ([195.92.253.2]:33218 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752853AbcFCV0z (ORCPT ); Fri, 3 Jun 2016 17:26:55 -0400 Date: Fri, 3 Jun 2016 22:26:52 +0100 From: Al Viro To: Linus Torvalds Cc: Oleg Drokin , " Mailing List" , "" Subject: Re: Dcache oops Message-ID: <20160603212652.GT14480@ZenIV.linux.org.uk> References: <20160603033750.GL14480@ZenIV.linux.org.uk> <0C971585-6BFC-4665-832B-9B262F733BFC@linuxhacker.ru> <20160603042648.GN14480@ZenIV.linux.org.uk> <74306F63-DBDF-4DED-85D2-5C3FB21B8A1E@linuxhacker.ru> <20160603182203.GR14480@ZenIV.linux.org.uk> <4285E00F-7228-485C-AD32-97552ED746F2@linuxhacker.ru> <20160603200759.GS14480@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Fri, Jun 03, 2016 at 02:18:15PM -0700, Linus Torvalds wrote: > So something must have corrupted the qstr. > > The remaining length *should* in %edi, judging by the > > 0xffffffff81243b82 <+306>: cmp $0x7,%edi > > in the __d_lookup() disassembly. And %rdi contains 2, so there were > supposed to be two more characters at 'ct' (which is %rdx). ... and since r8 and rsi are 0, we couldn't have consumed anything. > > Why would nd->last.name be bogus? I don't see anything. An interesting part is that it's page-aligned. Which is impossible for a short name obtained by getname(), but is quite likely for a symlink body. So at a guess, we have a page containing a symlink body freed under us.