1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158
| pwndbg> c Continuing. ERROR: Could not find ELF base!
Thread 1 hit Hardware watchpoint 11: *0xffffc9000020be08
Old value = 2145817 New value = -1068476911 0xffffffff84000f51 in error_entry () at arch/x86/entry/entry_64.S:873 873 PUSH_AND_CLEAR_REGS save_ret=1 LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA ───────────────────────────────────────────────────────────────────────[ REGISTERS ]──────────────────────────────────────────────────────────────────────── *RAX 0xffffffff82dca52a (v4l2_ioctl+106) ◂— mov rdi, r12 /* 0x894cfe8944e7894c */ *RBX 0xffffffff82dcb980 ◂— push rbp /* 0x56415741e5894855 */ RCX 0xffff888130588f00 ◂— 0 *RDX 0x0 RDI 0xffff8881397ad700 ◂— 0 *RSI 0xffffffff84000bfa (asm_sysvec_apic_timer_interrupt+10) ◂— mov rdi, rsp /* 0xffe89d6ee8e78948 */ R8 0x0 R9 0x0 R10 0x0 R11 0xffffffff82dca4c0 (v4l2_ioctl) ◂— push rbp /* 0x56415741e5894855 */ R12 0xffff8881397ad700 ◂— 0 R13 0xc0505611 R14 0x20000100 ◂— add byte ptr [rax], al /* 0x900000000 */ R15 0xc0505611 *RBP 0xffffc9000020beb0 —▸ 0xffffc9000020bee0 —▸ 0xffffc9000020bf18 —▸ 0xffffc9000020bf30 —▸ 0xffffc9000020bf48 ◂— ... *RSP 0xffffc9000020be08 ◂— adc dword ptr [rsi + 0x50], edx /* 0xc0505611 */ *RIP 0xffffffff84000f51 (error_entry+33) ◂— push rsi /* 0xc03145c931d23156 */ ─────────────────────────────────────────────────────────────────────────[ DISASM ]───────────────────────────────────────────────────────────────────────── ► 0xffffffff84000f51 <error_entry+33> push rsi <0xffffffff84000bfa> ↓ 0xffffffff84000f54 <error_entry+36> xor ecx, ecx 0xffffffff84000f56 <error_entry+38> xor r8d, r8d 0xffffffff84000f59 <error_entry+41> xor r9d, r9d 0xffffffff84000f5c <error_entry+44> xor r10d, r10d 0xffffffff84000f5f <error_entry+47> xor r11d, r11d 0xffffffff84000f62 <error_entry+50> xor ebx, ebx 0xffffffff84000f64 <error_entry+52> xor ebp, ebp 0xffffffff84000f66 <error_entry+54> xor r12d, r12d 0xffffffff84000f69 <error_entry+57> xor r13d, r13d 0xffffffff84000f6c <error_entry+60> xor r14d, r14d ─────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────── In file: /home/acdxvfsvd/linux-5.8-rc5/arch/x86/entry/entry_64.S 868 * Save all registers in pt_regs, and switch GS if needed. 869 */ 870 SYM_CODE_START_LOCAL(error_entry) 871 UNWIND_HINT_FUNC 872 cld ► 873 PUSH_AND_CLEAR_REGS save_ret=1 874 ENCODE_FRAME_POINTER 8 875 testb $3, CS+8(%rsp) 876 jz .Lerror_kernelspace 877 878 /* ─────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────── 00:0000│ rsp 0xffffc9000020be08 ◂— adc dword ptr [rsi + 0x50], edx /* 0xc0505611 */ 01:0008│ 0xffffc9000020be10 —▸ 0x20000100 ◂— add byte ptr [rax], al /* 0x900000000 */ 02:0010│ 0xffffc9000020be18 ◂— adc dword ptr [rsi + 0x50], edx /* 0xc0505611 */ 03:0018│ 0xffffc9000020be20 —▸ 0xffff8881397ad700 ◂— 0 04:0020│ 0xffffc9000020be28 —▸ 0xffffc9000020beb0 —▸ 0xffffc9000020bee0 —▸ 0xffffc9000020bf18 —▸ 0xffffc9000020bf30 ◂— ... 05:0028│ 0xffffc9000020be30 —▸ 0xffffffff82dcb980 ◂— push rbp /* 0x56415741e5894855 */ 06:0030│ 0xffffc9000020be38 —▸ 0xffffffff82dca4c0 (v4l2_ioctl) ◂— push rbp /* 0x56415741e5894855 */ 07:0038│ 0xffffc9000020be40 ◂— 0 ───────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────── ► f 0 ffffffff84000f51 error_entry+33 f 1 c0505611 f 2 20000100 f 3 c0505611 f 4 ffff8881397ad700 f 5 ffffc9000020beb0 f 6 ffffffff82dcb980 f 7 ffffffff82dca52a v4l2_ioctl+106 f 8 ffffffff8141d1e0 __se_sys_ioctl+160 f 9 ffffffff8141d1e0 __se_sys_ioctl+160 f 10 ffffffff8141d1e0 __se_sys_ioctl+160 ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── pwndbg> c Continuing. ERROR: Could not find ELF base!
Thread 1 hit Breakpoint 1, video_put_user (arg=0x20000100, parg=0xffffc9000020bd50, cmd=3226490385) at drivers/media/v4l2-core/v4l2-ioctl.c:3211 3211 .index = vb->index, LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA ───────────────────────────────────────────────────────────────────────[ REGISTERS ]──────────────────────────────────────────────────────────────────────── *RAX 0xffffffff82dcb4e6 ◂— mov eax, dword ptr [r12] /* 0xd024848924048b41 */ *RBX 0x40 RCX 0xffff888130588f00 ◂— 8 RDX 0x0 *RDI 0xffff88813aa0fbc0 ◂— and byte ptr [rdi + rsi*2 + 0x1eced17b], 0xa1 /* 0xa11eced17b77a480 */ *RSI 0x0 *R8 0xffff88813bc2d9f0 —▸ 0xffff88813aa0fb40 ◂— adc al, byte ptr [rbx] /* 0x502d3682b3e50312 */ *R9 0xffff88813aa0fb80 ◂— 0 *R10 0xffff88813aa0fb80 ◂— 0 *R11 0xffff88813b0036c0 ◂— 0x2d9f0 *R12 0xffffc9000020bd50 ◂— add byte ptr [rax], al /* 0x900000000 */ *R13 0xfffffffffffffff2 *R14 0xffff88813aa0fb80 ◂— 0 R15 0xc0505611 *RBP 0xffffc9000020be88 —▸ 0xffffc9000020beb0 —▸ 0xffffc9000020bee0 —▸ 0xffffc9000020bf18 —▸ 0xffffc9000020bf30 ◂— ... *RSP 0xffffc9000020bd00 —▸ 0xffff8881393b21d0 ◂— mov al, 0x21 /* 0xd21b0 */ *RIP 0xffffffff82dcb4e6 ◂— mov eax, dword ptr [r12] /* 0xd024848924048b41 */ ─────────────────────────────────────────────────────────────────────────[ DISASM ]───────────────────────────────────────────────────────────────────────── ► 0xffffffff82dcb4e6 mov eax, dword ptr [r12] 0xffffffff82dcb4ea <video_usercopy+1866> mov dword ptr [rsp + 0xd0], eax 0xffffffff82dcb4f1 mov eax, dword ptr [r12 + 4] 0xffffffff82dcb4f6 mov dword ptr [rsp + 0xd4], eax 0xffffffff82dcb4fd mov eax, dword ptr [r12 + 8] 0xffffffff82dcb502 mov dword ptr [rsp + 0xd8], eax 0xffffffff82dcb509 mov eax, dword ptr [r12 + 0xc] 0xffffffff82dcb50e mov dword ptr [rsp + 0xdc], eax 0xffffffff82dcb515 mov eax, dword ptr [r12 + 0x10] 0xffffffff82dcb51a mov dword ptr [rsp + 0xe0], eax 0xffffffff82dcb521 mov eax, dword ptr [r12 + 0x18] ─────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────── In file: /home/acdxvfsvd/linux-5.8-rc5/drivers/media/v4l2-core/v4l2-ioctl.c 3206 case VIDIOC_QBUF_TIME32: 3207 case VIDIOC_DQBUF_TIME32: 3208 case VIDIOC_PREPARE_BUF_TIME32: { 3209 struct v4l2_buffer *vb = parg; 3210 struct v4l2_buffer_time32 vb32 = { ► 3211 .index = vb->index, 3212 .type = vb->type, 3213 .bytesused = vb->bytesused, 3214 .flags = vb->flags, 3215 .field = vb->field, 3216 .timestamp.tv_sec = vb->timestamp.tv_sec, ─────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────── 00:0000│ rsp 0xffffc9000020bd00 —▸ 0xffff8881393b21d0 ◂— mov al, 0x21 /* 0xd21b0 */ 01:0008│ 0xffffc9000020bd08 ◂— xchg byte ptr [rdx], sil /* 0x28132864a */ 02:0010│ 0xffffc9000020bd10 ◂— 0 ... ↓ 04:0020│ 0xffffc9000020bd20 —▸ 0xffffc9000020bd90 ◂— 0 05:0028│ 0xffffc9000020bd28 —▸ 0xffff8881397ad700 ◂— 0 06:0030│ 0xffffc9000020bd30 —▸ 0xffffc9000020be98 —▸ 0xffffffff82dcb980 ◂— push rbp /* 0x56415741e5894855 */ 07:0038│ 0xffffc9000020bd38 ◂— 0 ───────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────── ► f 0 ffffffff82dcb4e6 f 1 ffffffff82dcb4e6 f 2 ffffffff82dcb9ac video_ioctl2+44 f 3 ffffffff82dca53b v4l2_ioctl+123 f 4 ffffffff8141d1e0 __se_sys_ioctl+160 f 5 ffffffff8141d1e0 __se_sys_ioctl+160 f 6 ffffffff8141d1e0 __se_sys_ioctl+160 f 7 ffffffff8141d1e0 __se_sys_ioctl+160 f 8 ffffffff8141d12e __x64_sys_ioctl+30 f 9 ffffffff83e875ec do_syscall_64+76 f 10 ffffffff84000068 entry_SYSCALL_64+104 ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── pwndbg> p &vb32.m $22 = (union {...} *) 0xffffc9000020be08 pwndbg> i b Num Type Disp Enb Address What 1 breakpoint keep y 0xffffffff82dcb4e6 in video_usercopy at drivers/media/v4l2-core/v4l2-ioctl.c:3211 breakpoint already hit 19 times 7 breakpoint keep y <PENDING> *main 11 hw watchpoint keep y *0xffffc9000020be08 breakpoint already hit 2 times
|