lkml.org 
[lkml]   [2008]   [Jun]   [23]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
    /
    FromNick Piggin <>
    SubjectRe: Oops when using growisofs
    DateMon, 23 Jun 2008 16:59:07 +1000
    On Monday 23 June 2008 16:34, Andrew Morton wrote:
    > On Mon, 23 Jun 2008 00:28:20 +0200 Michael Buesch <mb@bu3sch.de> wrote:
    > > On Monday 23 June 2008 00:05:51 Michael Buesch wrote:
    > > > > Note: r9 and r3 are both NULL pointers. r3 is the value returned from
    > > > > alloc_page_buffers. R9 is a copy of that, which gets accessed.
    > > >
    > > > Hm, yeah. I looked at that code already, but I can't see how it could
    > > > return a NULL pointer.
    > >
    > > Well, actually, it can return a NULL pointer.
    > >
    > >  928         head = NULL;
    > >  929         offset = PAGE_SIZE;
    > >  930         while ((offset -= size) >= 0) {
    > > ...
    > >  949         }
    > >  950         return head;
    > >
    > > So if size, which is a passed in as parameter, is > PAGE_SIZE it will
    > > return NULL.
    > >
    > > The size parameter is calculated by doing
    > > blocksize = 1 << inode->i_blkbits;
    > > in an earlier function in the callchain.
    >
    > Yes, that's a more likely scenario.  isofs has a history of passing
    > garbage into the VFS.
    
    Yes isofs will pass in a too-big page here (IIRC 32K or something).
    And trigger this oops.
    
    
    
    \
     
     \ /
      Last update: 2008-06-23 09:03    [from the cache]
    ©2003-2008