Re: NULL pointer dereference in 3.3-rc6

Geert Uytterhoeven
2012-03-18T20:03:33Z

On Sun, Mar 18, 2012 at 13:52, Andreas Schwab <schwab@linux-m68k.org> wrote:
> Geert Uytterhoeven <geert@linux-m68k.org> writes:
>
>> I'm a bit puzzled, as the crash location is not a memory dereference but
>> the "set_fs(MAKE_MM_SEG(wbs));" in do_040writeback1().
>
> I guess the integer unit can move ahead while the memory unit processes
> the write.  Take a look at the places that jump to 0x5da8.

Thanks for the hint!

Given that a1 is zero, and d1 is 64, it looks like it's the movesl at
5e14 that caused the problem:

>> 5e14: 0e91 2800 movesl %d2,%a1@
>> 5e18: 2400 movel %d0,%d2
>> 5e1a: 608c bras 5da8 <berr_040cleanup+0x144>

This corresponds to

case BA_SIZE_LONG:
res = put_user(wbd, (int __user *)wba);

in do_040writeback1(). So wba is zero. Oops...