ARM汇编实战1：内核函数netlink_lookup
堆栈信息
Exception Class: Kernel (KE)
Current Executing Process:
[wpa_supplicant, 687][logwrapper, 686]
Backtrace:
[<c0327a40>] emmc_ipanic+0x4c/0x46c
[<c0068a8c>] notifier_call_chain+0x64/0xdc
[<c0068d34>] __atomic_notifier_call_chain+0x40/0x54
[<c0068d68>] atomic_notifier_call_chain+0x20/0x28
[<c0568654>] panic+0x7c/0x194
[<c00121e4>] die+0x120/0x2a0
[<c0568328>] __do_kernel_fault.part.9+0x5c/0x7c
[<c00157f8>] do_page_fault+0x23c/0x278
[<c0015960>] do_translation_fault+0xa0/0xa8
[<c00083c0>] do_DataAbort+0x7c/0x100
[<c000df58>] __dabt_svc+0x38/0x60
[<c045cab0>] netlink_unicast+0xac/0x204
[<c045cf70>] netlink_sendmsg+0x2c0/0x324
[<c0421318>] sock_sendmsg+0xac/0xcc
[<c04216c4>] __sys_sendmsg+0x2d4/0x2ec
[<c042314c>] sys_sendmsg+0x44/0x70
[<c000e500>] ret_fast_syscall+0x0/0x30
[<ffffffff>] 0xffffffff
Exception Detail Info:
<0>[ 1386.071540] (1)[687:wpa_supplicant]Internal error: Oops: 5 [#1] PREEMPT SMP ARM
<4>[ 1386.071553] (1)[687:wpa_supplicant]Modules linked in: wlan_mt bf1c3000 lowmemorydetect bf1bf000 ccci bf194000 ccci_plat bf165000 mtk_wmt_wifi bf161000 mtk_fm_drv bf136000 mtk_stp_bt bf129000 mtk_stp_gps bf11c000 mtk_stp_wmt bf091000 devinfo bf08d000 devapc bf088000 sec bf061000 vcodec_kernel_driver bf052000 bma2xx bf047000 mali bf000000
<4>[ 1386.071644] (1)[687:wpa_supplicant]CPU: 1 Tainted: G W (3.4.5 #1)
<4>[ 1386.071660] (1)[687:wpa_supplicant]PC is at netlink_lookup.isra.17+0x38/0x10c
<4>[ 1386.071676] (1)[687:wpa_supplicant]LR is at __raw_read_lock+0x24/0xa0
<4>[ 1386.071691] (1)[687:wpa_supplicant]pc : [<c045b7c0>] lr : [<c0571280>] psr: 60000013
<4>[ 1386.071699] (1)[687:wpa_supplicant]sp : dc99fcb0 ip : dc99fc88 fp : dc99fccc
<4>[ 1386.071714] (1)[687:wpa_supplicant]r10: 00000000 r9 : 00000028 r8 : 00000000
<4>[ 1386.071728] (1)[687:wpa_supplicant]r7 : dc99fcd4 r6 : 84000143 r5 : 00000380 r4 : 00000000
<4>[ 1386.071742] (1)[687:wpa_supplicant]r3 : 00000855 r2 : 0000beef r1 : deadbeef r0 : 840004c3
<4>[ 1386.071758] (1)[687:wpa_supplicant]Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
<4>[ 1386.071774] (1)[687:wpa_supplicant]Control: 10c5387d Table: 9e63806a DAC: 00000015
源代码
static struct sock *netlink_lookup(struct net *net, int protocol, u32 pid)
{
struct nl_pid_hash *hash = &nl_table[protocol].hash;
struct hlist_head *head;
struct sock *sk;
struct hlist_node *node;
read_lock(&nl_table_lock);
head = nl_pid_hashfn(hash, pid);
sk_for_each(sk, node, head) {
if (net_eq(sock_net(sk), net) && (nlk_sk(sk)->pid == pid)) {
sock_hold(sk);
goto found;
}
}
sk = NULL;
found:
read_unlock(&nl_table_lock);
return sk;
}
static inline
int net_eq(const struct net *net1, const struct net *net2)
{
return 1;
}
反汇编
sys/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.6/bin/arm-linux-androideabi-objdump -S -l -z vmlinux > vmlinux.txt
sys/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.6/bin/arm-linux-androideabi-objdump -j .text -S vmlinux > vmlinux.txt
c045b788 <netlink_lookup.isra.17>:
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:229
c045b788: e1a0c00d mov ip, sp
c045b78c: e92dd878 push {r3, r4, r5, r6, fp, ip, lr, pc}
c045b790: e24cb004 sub fp, ip, #4
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:231 ;
c045b794: e0605180 rsb r5, r0, r0, lsl #3 ;r5 = 7* protocol, r0 = protocol
c045b798: e59f00ec ldr r0, [pc, #236] ; c045b88c <PRRR+0xc13b36e4> ; r0 = nl_table
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:229
c045b79c: e1a04001 mov r4, r1 ; r4 = pid
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:231
c045b7a0: e1a05185 lsl r5, r5, #3 ;r5 = 56 * protocol
c045b7a4: e4906004 ldr r6, [r0], #4 ; r6 = nl_table, r0 = nl_table_lock
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:236
c045b7a8: eb0456d3 bl c05712fc <_raw_read_lock>
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7ac: e30b1eef movw r1, #48879 ; 0xbeef
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:231
c045b7b0: e0860005 add r0, r6, r5 ; r0 = &nl_table[protocol]
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7b4: e34d1ead movt r1, #57005 ; 0xdead
c045b7b8: e30b2eef movw r2, #48879 ; 0xbeef
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7bc: e3003855 movw r3, #2133 ; 0x855
c045b7c0: e590e018 ldr lr, [r0, #24] ; &nl_table[protocol].hash->rnd
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7c4: e34d2ead movt r2, #57005 ; 0xdead
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7c8: e3493044 movt r3, #36932 ; 0x9044
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:151
c045b7cc: e0842002 add r2, r4, r2
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7d0: e02ee001 eor lr, lr, r1
nl_pid_hashfn():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:149
c045b7d4: e590c008 ldr ip, [r0, #8]
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7d8: e08e3003 add r3, lr, r3
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b7dc: e7960005 ldr r0, [r6, r5]
jhash_3words():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/linux/jhash.h:155
c045b7e0: e0222003 eor r2, r2, r3
c045b7e4: e0422ae3 sub r2, r2, r3, ror #21
c045b7e8: e0221001 eor r1, r2, r1
c045b7ec: e04113e2 sub r1, r1, r2, ror #7
c045b7f0: e0213003 eor r3, r1, r3
c045b7f4: e0433861 sub r3, r3, r1, ror #16
c045b7f8: e0232002 eor r2, r3, r2
c045b7fc: e0422e63 sub r2, r2, r3, ror #28
c045b800: e0221001 eor r1, r2, r1
c045b804: e0411962 sub r1, r1, r2, ror #18
c045b808: e0213003 eor r3, r1, r3
c045b80c: e0431461 sub r1, r3, r1, ror #8
nl_pid_hashfn():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:149
c045b810: e001100c and r1, r1, ip
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b814: e7903101 ldr r3, [r0, r1, lsl #2]
c045b818: e3530000 cmp r3, #0
c045b81c: 0a00000a beq c045b84c <netlink_lookup.isra.17+0xc4>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:239
c045b820: e5932180 ldr r2, [r3, #384] ; 0x180
c045b824: e1540002 cmp r4, r2
c045b828: 1a000003 bne c045b83c <netlink_lookup.isra.17+0xb4>
c045b82c: ea00000b b c045b860 <netlink_lookup.isra.17+0xd8>
c045b830: e5932180 ldr r2, [r3, #384] ; 0x180
c045b834: e1540002 cmp r4, r2
c045b838: 0a000009 beq c045b864 <netlink_lookup.isra.17+0xdc>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b83c: e5933000 ldr r3, [r3]
c045b840: e3530000 cmp r3, #0
c045b844: e2435020 sub r5, r3, #32
c045b848: 1afffff8 bne c045b830 <netlink_lookup.isra.17+0xa8>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:244 ;sk = null
c045b84c: e1a05003 mov r5, r3
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:246
c045b850: e59f0038 ldr r0, [pc, #56] ; c045b890 <PRRR+0xc13b36e8>
c045b854: eb04552c bl c0570d0c <_raw_read_unlock>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:248
c045b858: e1a00005 mov r0, r5
c045b85c: e89da878 ldm sp, {r3, r4, r5, r6, fp, sp, pc}
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:238
c045b860: e2435020 sub r5, r3, #32
sock_hold():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/include/net/sock.h:490
c045b864: e283200c add r2, r3, #12
atomic_add():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/arch/arm/include/asm/atomic.h:55
c045b868: e1921f9f ldrex r1, [r2]
c045b86c: e2811001 add r1, r1, #1
c045b870: e1820f91 strex r0, r1, [r2]
c045b874: e3300000 teq r0, #0
c045b878: 1afffffa bne c045b868 <netlink_lookup.isra.17+0xe0>
netlink_lookup():
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:246
c045b87c: e59f000c ldr r0, [pc, #12] ; c045b890 <PRRR+0xc13b36e8>
c045b880: eb045521 bl c0570d0c <_raw_read_unlock>
/home/buildslave/jenkins_build/sofina_td/sys/kernel/net/netlink/af_netlink.c:248
c045b884: e1a00005 mov r0, r5
c045b888: e89da878 ldm sp, {r3, r4, r5, r6, fp, sp, pc}
c045b88c: c0aa2968 .word 0xc0aa2968
c045b890: c0aa296c .word 0xc0aa296c
c057125c <__raw_read_lock>:
c057125c: e1a0c00d mov ip, sp
c0571260: e92dd830 push {r4, r5, fp, ip, lr, pc}
c0571264: e24cb004 sub fp, ip, #4
c0571268: e1a0300d mov r3, sp
c057126c: e3c35d7f bic r5, r3, #8128 ; 0x1fc0
c0571270: e3c5503f bic r5, r5, #63 ; 0x3f
c0571274: e1a04000 mov r4, r0
c0571278: e3a00001 mov r0, #1
c057127c: ebebed75 bl c006c858 <add_preempt_count>
c0571280: e3a00001 mov r0, #1
c0571284: e1a03000 mov r3, r0
c0571288: e1942f9f ldrex r2, [r4]
c057128c: e2922001 adds r2, r2, #1
c0571290: 51843f92 strexpl r3, r2, [r4]
c0571294: f57ff05f dmb sy
c0571298: e3530000 cmp r3, #0
c057129c: 1a000001 bne c05712a8 <__raw_read_lock+0x4c>
c05712a0: e5843004 str r3, [r4, #4]
c05712a4: e89da830 ldm sp, {r4, r5, fp, sp, pc}
c05712a8: ebebed3c bl c006c7a0 <sub_preempt_count>
c05712ac: e5953000 ldr r3, [r5]
c05712b0: e3130002 tst r3, #2
c05712b4: 1a00000e bne c05712f4 <__raw_read_lock+0x98>
c05712b8: e5943004 ldr r3, [r4, #4]
c05712bc: e3530000 cmp r3, #0
c05712c0: 03a03001 moveq r3, #1
c05712c4: 05843004 streq r3, [r4, #4]
c05712c8: e5943000 ldr r3, [r4]
c05712cc: e3530000 cmp r3, #0
c05712d0: ba000003 blt c05712e4 <__raw_read_lock+0x88>
c05712d4: eaffffe7 b c0571278 <__raw_read_lock+0x1c>
c05712d8: e5943000 ldr r3, [r4]
c05712dc: e3530000 cmp r3, #0
c05712e0: aaffffe4 bge c0571278 <__raw_read_lock+0x1c>
c05712e4: e5943004 ldr r3, [r4, #4]
c05712e8: e3530000 cmp r3, #0
c05712ec: 1afffff9 bne c05712d8 <__raw_read_lock+0x7c>
c05712f0: eaffffe0 b c0571278 <__raw_read_lock+0x1c>
c05712f4: ebfffb64 bl c057008c <preempt_schedule>
c05712f8: eaffffee b c05712b8 <__raw_read_lock+0x5c>