Re: Dcache oops

Al Viro
2016-06-03T21:26:57Z

On Fri, Jun 03, 2016 at 02:18:15PM -0700, Linus Torvalds wrote:

> So something must have corrupted the qstr.
>
> The remaining length *should* in %edi, judging by the
>
> 0xffffffff81243b82 <+306>: cmp $0x7,%edi
>
> in the __d_lookup() disassembly. And %rdi contains 2, so there were
> supposed to be two more characters at 'ct' (which is %rdx).

... and since r8 and rsi are 0, we couldn't have consumed anything.
>
> Why would nd->last.name be bogus? I don't see anything.

An interesting part is that it's page-aligned. Which is impossible for
a short name obtained by getname(), but is quite likely for a symlink body.
So at a guess, we have a page containing a symlink body freed under us.