Messages in this thread | | | Date | Mon, 18 Nov 2013 11:33:25 +1100 | From | Kevin Easton <> | Subject | Re: 3.12: kernel panic when resuming from suspend to RAM (x86_64) |
| |
On Sun, Nov 17, 2013 at 11:06:12PM +0100, Borislav Petkov wrote: > and the virtual address in rIP is ffffffff8106f5c3, i.e. the same one > as in the photo. Thus, the CALL instruction tries to call the timer > function 'fn' which we pass as an argument to call_timer_fn. > > However, the address we're trying to call in %r14 is garbage: > 0x455300323d504544 and not in canonical form, causing the #GP.
That's part of an ASCII string, "DEP=2\0SE", so if that looks familiar to anyone (part of a kernel command line?) it might give a clue to where the timer callback pointer is being overwritten.
> So basically what happens is suspend to RAM corrupts something > containing one or more timer functions and we end up calling crap after > resume.
- Kevin
| |