[PATCH] fix for initrd panic in 2.4.5

[PATCH] fix for initrd panic in 2.4.5

[James Bottomley]

[-- Attachment #1: Type: text/plain, Size: 375 bytes --]

Not many people have seen this, but the i_bdev field in fake_inode in 
ioctl_by_bdev() is uninitialised.  Since this field is dereferenced by 
BLKFLSBUF in rd_ioctl, it can lead to a panic (depending on what happens to be 
on the stack).  The attached fixes the problem and clears all the fields in 
fake_inode to make any other problems like this show up.

James Bottomley


[-- Attachment #2: linux-2.4.5-initrd.diff --]
[-- Type: text/plain , Size: 768 bytes --]

Index: fs/block_dev.c
===================================================================
RCS file: /home/jejb/CVSROOT/linux/2.4/fs/block_dev.c,v
retrieving revision 1.1.1.10
diff -u -r1.1.1.10 block_dev.c
--- fs/block_dev.c	2001/05/26 15:33:37	1.1.1.10
+++ fs/block_dev.c	2001/06/02 13:14:35
@@ -596,13 +596,14 @@
 int ioctl_by_bdev(struct block_device *bdev, unsigned cmd, unsigned long arg)
 {
 	kdev_t rdev = to_kdev_t(bdev->bd_dev);
-	struct inode inode_fake;
+	struct inode inode_fake = { 0 };
 	int res;
 	mm_segment_t old_fs = get_fs();
 
 	if (!bdev->bd_op->ioctl)
 		return -EINVAL;
 	inode_fake.i_rdev=rdev;
+	inode_fake.i_bdev = bdev;
 	init_waitqueue_head(&inode_fake.i_wait);
 	set_fs(KERNEL_DS);
 	res = bdev->bd_op->ioctl(&inode_fake, NULL, cmd, arg);

Re: [PATCH] fix for initrd panic in 2.4.5

[Juan Quintela]

>>>>> "james" == James Bottomley <James.Bottomley@SteelEye.com> writes:

james> Not many people have seen this, but the i_bdev field in fake_inode in 
james> ioctl_by_bdev() is uninitialised.  Since this field is dereferenced by 
james> BLKFLSBUF in rd_ioctl, it can lead to a panic (depending on what happens to be 
james> on the stack).  The attached fixes the problem and clears all the fields in 
james> fake_inode to make any other problems like this show up.

see the fix in ac kernels,  you have a bdev there to put in the
fake_inode.

Later, Juan.


james> Index: fs/block_dev.c
james> ===================================================================
james> RCS file: /home/jejb/CVSROOT/linux/2.4/fs/block_dev.c,v
james> retrieving revision 1.1.1.10
james> diff -u -r1.1.1.10 block_dev.c
james> --- fs/block_dev.c	2001/05/26 15:33:37	1.1.1.10
james> +++ fs/block_dev.c	2001/06/02 13:14:35
james> @@ -596,13 +596,14 @@
james> int ioctl_by_bdev(struct block_device *bdev, unsigned cmd, unsigned long arg)
james> {
james> kdev_t rdev = to_kdev_t(bdev->bd_dev);
james> -	struct inode inode_fake;
james> +	struct inode inode_fake = { 0 };
james> int res;
james> mm_segment_t old_fs = get_fs();
 
james> if (!bdev->bd_op->ioctl)
james> return -EINVAL;
james> inode_fake.i_rdev=rdev;
james> +	inode_fake.i_bdev = bdev;
james> init_waitqueue_head(&inode_fake.i_wait);
james> set_fs(KERNEL_DS);
james> res = bdev->bd_op->ioctl(&inode_fake, NULL, cmd, arg);

-- 
In theory, practice and theory are the same, but in practice they 
are different -- Larry McVoy