diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2007-02-18 13:52:14 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@openwrt.org> | 2007-02-18 13:52:14 +0000 |
| commit | 912e5867ef2685298e547972d968458f600be969 (patch) | |
| tree | 0579a8c5c5338927bf37d7079e2a84bf8351b5e0 /target/linux | |
| parent | 9b47712459d0248770fb497960266623217e2fb7 (diff) | |
| download | upstream-912e5867ef2685298e547972d968458f600be969.tar.gz upstream-912e5867ef2685298e547972d968458f600be969.tar.bz2 upstream-912e5867ef2685298e547972d968458f600be969.zip | |
Finally fix the pesky x86-2.6 block2mtd related crash (#1058) When erasing blocks, block2mtd checks the block on the physical disk to see if everything's filled with 0xff. When grabbing a page from the page cache, it initializes the limit as <start address> + PAGE_SIZE. Turns out that the pointer to the status page is (unsigned long *), and thus it adds (PAGE_SIZE * 4). This would never have been caught, if it wasn't for the unlikely event that block2mtd catches the *last* page available in the system ram and thus tries to scan 4 memory pages from there. The absolutely trivial fix is to do a double cast (cast to (u8 *), add PAGE_SIZE, then cast to (unsigned long *))
... and there was much rejoicing
SVN-Revision: 6318
Diffstat (limited to 'target/linux')
| -rw-r--r-- | target/linux/generic-2.6/patches/212-block2mtd_erase_scan.patch | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/target/linux/generic-2.6/patches/212-block2mtd_erase_scan.patch b/target/linux/generic-2.6/patches/212-block2mtd_erase_scan.patch new file mode 100644 index 0000000000..76b4f5d4c9 --- /dev/null +++ b/target/linux/generic-2.6/patches/212-block2mtd_erase_scan.patch @@ -0,0 +1,11 @@ +--- linux.dev/drivers/mtd/devices/block2mtd.c.old 2007-02-18 14:08:59.519952312 +0100 ++++ linux.dev/drivers/mtd/devices/block2mtd.c 2007-02-18 14:09:04.219237912 +0100 +@@ -111,7 +111,7 @@ + if (IS_ERR(page)) + return PTR_ERR(page); + +- max = (u_long*)page_address(page) + PAGE_SIZE; ++ max = (u_long*) ((u8 *) page_address(page) + PAGE_SIZE); + for (p=(u_long*)page_address(page); p<max; p++) + if (*p != -1UL) { + lock_page(page); |