Messages in this thread | | | From | Nick Piggin <> | Subject | Re: Oops when using growisofs | Date | Mon, 23 Jun 2008 16:59:07 +1000 |
| |
On Monday 23 June 2008 16:34, Andrew Morton wrote: > On Mon, 23 Jun 2008 00:28:20 +0200 Michael Buesch <mb@bu3sch.de> wrote: > > On Monday 23 June 2008 00:05:51 Michael Buesch wrote: > > > > Note: r9 and r3 are both NULL pointers. r3 is the value returned from > > > > alloc_page_buffers. R9 is a copy of that, which gets accessed. > > > > > > Hm, yeah. I looked at that code already, but I can't see how it could > > > return a NULL pointer. > > > > Well, actually, it can return a NULL pointer. > > > > 928 head = NULL; > > 929 offset = PAGE_SIZE; > > 930 while ((offset -= size) >= 0) { > > ... > > 949 } > > 950 return head; > > > > So if size, which is a passed in as parameter, is > PAGE_SIZE it will > > return NULL. > > > > The size parameter is calculated by doing > > blocksize = 1 << inode->i_blkbits; > > in an earlier function in the callchain. > > Yes, that's a more likely scenario. isofs has a history of passing > garbage into the VFS.
Yes isofs will pass in a too-big page here (IIRC 32K or something). And trigger this oops.
| |