From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linus Torvalds Subject: Re: linux-next: Tree for June 3 Date: Fri, 4 Jun 2010 13:04:00 -0700 (PDT) Message-ID: References: <20100603134753.710a64b3.sfr@canb.auug.org.au> <201006032222.57411.rusty@rustcorp.com.au> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Return-path: Received: from smtp1.linux-foundation.org ([140.211.169.13]:44413 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750762Ab0FDUJd (ORCPT ); Fri, 4 Jun 2010 16:09:33 -0400 In-Reply-To: Sender: linux-next-owner@vger.kernel.org List-ID: To: Tony Luck Cc: Rusty Russell , Dave Young , Stephen Rothwell , linux-next@vger.kernel.org, LKML On Fri, 4 Jun 2010, Tony Luck wrote: > > At the point of dereference it looks like we were trying > to load a 4-byte data object from offset 552 into the > "struct module *" that wa returned by load_module(). Sounds like 'mod->num_ctors' loaded by do_mod_ctors(). It's a 4-byte field in roughly that area. What does a NaT consumption fault mean, and does it give the invalid address it was loaded off? In the successful path of "load_module()", we will have dereferenced the "mod" pointer we return just before, so I wonder if there's some error case that incorrectly returns a positive errno instead of a negative one, and causes us to miss the "IS_ERR()" check or something. There's a couple of checking routines in module.c that do not return a negative error, but instead return 0/1. The one I looked at was converted into a negative error, but there are several cases of if (err) return ERR_PTR(err) and if something does that on a 0/1 value, it will return a bogus pointer. Linus