Re: [PATCH] block2mtd oops in erase function.

Jörn Engel
2007-02-19T22:24:50Z

On Mon, 19 February 2007 22:29:39 +0100, Felix Fietkau wrote:
>
> Hi, I have a small fix for a crash that happened when I was using jffs2
> in combination with block2mtd.c
>
> In the erase function when checking the block to see if it's already
> erased, the limit is to be set to the page_address(page) + PAGE_SIZE,
> but because the variable has the type (ulong *), it gets set to
> PAGE_SIZE*sizeof(ulong), which makes the kernel oops when the page is
> very close to the end of RAM.

Good catch! What a twisted little piece of code you've found.

> Signed-off-by: Felix Fietkau <nbd@openwrt.org>
>
> --- linux.dev/drivers/mtd/devices/block2mtd.c.old 2007-02-18 14:08:59.519952312 +0100
> +++ linux.dev/drivers/mtd/devices/block2mtd.c 2007-02-18 14:09:04.219237912 +0100
> @@ -111,7 +111,7 @@
> if (IS_ERR(page))
> return PTR_ERR(page);
>
> - max = (u_long*)page_address(page) + PAGE_SIZE;
> + max = (u_long*) ((u8 *) page_address(page) + PAGE_SIZE);
> for (p=(u_long*)page_address(page); p<max; p++)
> if (*p != -1UL) {
> lock_page(page);

The proper fix would be to remove the cast instead of adding yet
another. I wonder when those got added.

Jörn

--
He who knows others is wise.
He who knows himself is enlightened.
-- Lao Tsu