现在的位置: 首页 > 综合 > 正文

ARM汇编实战1:内核函数netlink_lookup

2018年04月16日 ⁄ 综合 ⁄ 共 9528字 ⁄ 字号 评论关闭

堆栈信息

Exception Class: Kernel (KE)
Current Executing Process:
[wpa_supplicant, 687][logwrapper, 686]
Backtrace:
[<c0327a40>] emmc_ipanic+0x4c/0x46c
[<c0068a8c>] notifier_call_chain+0x64/0xdc
[<c0068d34>] __atomic_notifier_call_chain+0x40/0x54
[<c0068d68>] atomic_notifier_call_chain+0x20/0x28
[<c0568654>] panic+0x7c/0x194
[<c00121e4>] die+0x120/0x2a0
[<c0568328>] __do_kernel_fault.part.9+0x5c/0x7c
[<c00157f8>] do_page_fault+0x23c/0x278
[<c0015960>] do_translation_fault+0xa0/0xa8
[<c00083c0>] do_DataAbort+0x7c/0x100
[<c000df58>] __dabt_svc+0x38/0x60
[<c045cab0>] netlink_unicast+0xac/0x204
[<c045cf70>] netlink_sendmsg+0x2c0/0x324
[<c0421318>] sock_sendmsg+0xac/0xcc
[<c04216c4>] __sys_sendmsg+0x2d4/0x2ec
[<c042314c>] sys_sendmsg+0x44/0x70
[<c000e500>] ret_fast_syscall+0x0/0x30
[<ffffffff>] 0xffffffff

Exception Detail Info:
<0>[ 1386.071540] (1)[687:wpa_supplicant]Internal error: Oops: 5 [#1] PREEMPT SMP ARM
<4>[ 1386.071553] (1)[687:wpa_supplicant]Modules linked in: wlan_mt bf1c3000  lowmemorydetect bf1bf000  ccci bf194000  ccci_plat bf165000  mtk_wmt_wifi bf161000  mtk_fm_drv bf136000  mtk_stp_bt bf129000  mtk_stp_gps bf11c000  mtk_stp_wmt bf091000  devinfo bf08d000 
devapc bf088000  sec bf061000  vcodec_kernel_driver bf052000  bma2xx bf047000  mali bf000000
<4>[ 1386.071644] (1)[687:wpa_supplicant]CPU: 1    Tainted: G        W     (3.4.5 #1)
<4>[ 1386.071660] (1)[687:wpa_supplicant]
PC is at netlink_lookup.isra.17+0x38/0x10c
<4>[ 1386.071676] (1)[687:wpa_supplicant]
LR is at __raw_read_lock+0x24/0xa0
<4>[ 1386.071691] (1)[687:wpa_supplicant]pc : [<c045b7c0>]    lr : [<c0571280>]    psr: 60000013
<4>[ 1386.071699] (1)[687:wpa_supplicant]sp : dc99fcb0  ip : dc99fc88  fp : dc99fccc
<4>[ 1386.071714] (1)[687:wpa_supplicant]r10: 00000000  r9 : 00000028  r8 : 00000000
<4>[ 1386.071728] (1)[687:wpa_supplicant]r7 : dc99fcd4  r6 : 84000143  r5 : 00000380  r4 : 00000000
<4>[ 1386.071742] (1)[687:wpa_supplicant]r3 : 00000855  r2 : 0000beef  r1 : deadbeef  r0 : 840004c3
<4>[ 1386.071758] (1)[687:wpa_supplicant]Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
<4>[ 1386.071774] (1)[687:wpa_supplicant]Control: 10c5387d  Table: 9e63806a  DAC: 00000015

 

源代码

static struct sock *netlink_lookup(struct net *net, int protocol, u32 pid)
{
    struct nl_pid_hash *hash = &nl_table[protocol].hash;
    struct hlist_head *head;
    struct sock *sk;
    struct hlist_node *node;

    read_lock(&nl_table_lock);
    head = nl_pid_hashfn(hash, pid);
    sk_for_each(sk, node, head) {
        if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->pid == pid)) {
            sock_hold(sk);
            goto found;
        }
    }
    sk = NULL;
found:
    read_unlock(&nl_table_lock);
    return sk;
}

 

static inline
int net_eq(const struct net *net1, const struct net *net2)
{
 return 1;
}

反汇编

sys/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.6/bin/arm-linux-androideabi-objdump -S -l -z vmlinux > vmlinux.txt
sys/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.6/bin/arm-linux-androideabi-objdump -j .text -S vmlinux > vmlinux.txt

 

c045b788 <netlink_lookup.isra.17>:
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:229
c045b788: e1a0c00d  mov ip, sp
c045b78c: e92dd878  push {r3, r4, r5, r6, fp, ip, lr, pc}
c045b790: e24cb004  sub fp, ip, #4
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:231  ;

c045b794: e0605180  rsb r5, r0, r0, lsl #3 ;r5 = 7* protocol, r0 = protocol
c045b798: e59f00ec  ldr r0, [pc, #236] ; c045b88c <PRRR+0xc13b36e4>  ;
r0 = nl_table
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:229
c045b79c: e1a04001  mov r4, r1  ;
r4 = pid
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:231
c045b7a0: e1a05185  lsl r5, r5, #3 ;
r5 = 56 * protocol
c045b7a4: e4906004  ldr r6, [r0], #4  ;
r6 = nl_table, r0 = nl_table_lock
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:236
c045b7a8: eb0456d3  bl c05712fc <_raw_read_lock>
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7ac: e30b1eef  movw r1, #48879 ; 0xbeef
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:231
c045b7b0: e0860005  add r0, r6, r5 ; r0 = &nl_table[protocol]
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7b4: e34d1ead  movt r1, #57005 ; 0xdead
c045b7b8: e30b2eef  movw r2, #48879 ; 0xbeef
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7bc: e3003855  movw r3, #2133 ; 0x855
c045b7c0: e590e018  ldr lr, [r0, #24] ;
&nl_table[protocol].hash->rnd
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7c4: e34d2ead  movt r2, #57005 ; 0xdead
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7c8: e3493044  movt r3, #36932 ; 0x9044
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7cc: e0842002  add r2, r4, r2
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7d0: e02ee001  eor lr, lr, r1
nl_pid_hashfn():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:149
c045b7d4: e590c008  ldr ip, [r0, #8]
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7d8: e08e3003  add r3, lr, r3
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b7dc: e7960005  ldr r0, [r6, r5]
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7e0: e0222003  eor r2, r2, r3
c045b7e4: e0422ae3  sub r2, r2, r3, ror #21
c045b7e8: e0221001  eor r1, r2, r1
c045b7ec: e04113e2  sub r1, r1, r2, ror #7
c045b7f0: e0213003  eor r3, r1, r3
c045b7f4: e0433861  sub r3, r3, r1, ror #16
c045b7f8: e0232002  eor r2, r3, r2
c045b7fc: e0422e63  sub r2, r2, r3, ror #28
c045b800: e0221001  eor r1, r2, r1
c045b804: e0411962  sub r1, r1, r2, ror #18
c045b808: e0213003  eor r3, r1, r3
c045b80c: e0431461  sub r1, r3, r1, ror #8
nl_pid_hashfn():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:149
c045b810: e001100c  and r1, r1, ip
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b814: e7903101  ldr r3, [r0, r1, lsl #2]
c045b818: e3530000  cmp r3, #0
c045b81c: 0a00000a  beq c045b84c <netlink_lookup.isra.17+0xc4>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:239
c045b820: e5932180  ldr r2, [r3, #384] ; 0x180
c045b824: e1540002  cmp r4, r2
c045b828: 1a000003  bne c045b83c <netlink_lookup.isra.17+0xb4>
c045b82c: ea00000b  b c045b860 <netlink_lookup.isra.17+0xd8>
c045b830: e5932180  ldr r2, [r3, #384] ; 0x180
c045b834: e1540002  cmp r4, r2
c045b838: 0a000009  beq c045b864 <netlink_lookup.isra.17+0xdc>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b83c: e5933000  ldr r3, [r3]
c045b840: e3530000  cmp r3, #0
c045b844: e2435020  sub r5, r3, #32
c045b848: 1afffff8  bne c045b830 <netlink_lookup.isra.17+0xa8>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:244   ;sk = null
c045b84c: e1a05003  mov r5, r3
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:246
c045b850: e59f0038  ldr r0, [pc, #56] ; c045b890 <PRRR+0xc13b36e8>
c045b854: eb04552c  bl c0570d0c <_raw_read_unlock>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:248
c045b858: e1a00005  mov r0, r5
c045b85c: e89da878  ldm sp, {r3, r4, r5, r6, fp, sp, pc}
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b860: e2435020  sub r5, r3, #32
sock_hold():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/net/sock.h:490
c045b864: e283200c  add r2, r3, #12
atomic_add():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/arch/arm/include/asm/atomic.h:55
c045b868: e1921f9f  ldrex r1, [r2]
c045b86c: e2811001  add r1, r1, #1
c045b870: e1820f91  strex r0, r1, [r2]
c045b874: e3300000  teq r0, #0
c045b878: 1afffffa  bne c045b868 <netlink_lookup.isra.17+0xe0>
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:246
c045b87c: e59f000c  ldr r0, [pc, #12] ; c045b890 <PRRR+0xc13b36e8>
c045b880: eb045521  bl c0570d0c <_raw_read_unlock>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:248
c045b884: e1a00005  mov r0, r5
c045b888: e89da878  ldm sp, {r3, r4, r5, r6, fp, sp, pc}
c045b88c: c0aa2968  .word 0xc0aa2968
c045b890: c0aa296c  .word 0xc0aa296c

 

c057125c <__raw_read_lock>:
c057125c: e1a0c00d  mov ip, sp
c0571260: e92dd830  push {r4, r5, fp, ip, lr, pc}
c0571264: e24cb004  sub fp, ip, #4
c0571268: e1a0300d  mov r3, sp
c057126c: e3c35d7f  bic r5, r3, #8128 ; 0x1fc0
c0571270: e3c5503f  bic r5, r5, #63 ; 0x3f
c0571274: e1a04000  mov r4, r0
c0571278: e3a00001  mov r0, #1
c057127c: ebebed75  bl c006c858 <add_preempt_count>
c0571280: e3a00001  mov r0, #1
c0571284: e1a03000  mov r3, r0
c0571288: e1942f9f  ldrex r2, [r4]
c057128c: e2922001  adds r2, r2, #1
c0571290: 51843f92  strexpl r3, r2, [r4]
c0571294: f57ff05f  dmb sy
c0571298: e3530000  cmp r3, #0
c057129c: 1a000001  bne c05712a8 <__raw_read_lock+0x4c>
c05712a0: e5843004  str r3, [r4, #4]
c05712a4: e89da830  ldm sp, {r4, r5, fp, sp, pc}
c05712a8: ebebed3c  bl c006c7a0 <sub_preempt_count>
c05712ac: e5953000  ldr r3, [r5]
c05712b0: e3130002  tst r3, #2
c05712b4: 1a00000e  bne c05712f4 <__raw_read_lock+0x98>
c05712b8: e5943004  ldr r3, [r4, #4]
c05712bc: e3530000  cmp r3, #0
c05712c0: 03a03001  moveq r3, #1
c05712c4: 05843004  streq r3, [r4, #4]
c05712c8: e5943000  ldr r3, [r4]
c05712cc: e3530000  cmp r3, #0
c05712d0: ba000003  blt c05712e4 <__raw_read_lock+0x88>
c05712d4: eaffffe7  b c0571278 <__raw_read_lock+0x1c>
c05712d8: e5943000  ldr r3, [r4]
c05712dc: e3530000  cmp r3, #0
c05712e0: aaffffe4  bge c0571278 <__raw_read_lock+0x1c>
c05712e4: e5943004  ldr r3, [r4, #4]
c05712e8: e3530000  cmp r3, #0
c05712ec: 1afffff9  bne c05712d8 <__raw_read_lock+0x7c>
c05712f0: eaffffe0  b c0571278 <__raw_read_lock+0x1c>
c05712f4: ebfffb64  bl c057008c <preempt_schedule>
c05712f8: eaffffee  b c05712b8 <__raw_read_lock+0x5c>

抱歉!评论已关闭.