aboutsummaryrefslogtreecommitdiffstats
path: root/fs/jffs2
diff options
context:
space:
mode:
authorAlexey Korolev <akorolev@infradead.org>2008-04-14 15:45:06 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-04-14 18:43:14 -0400
commitabe2f41430770270a1512bf78f489284bfbdbd04 (patch)
treed40b557f0ce346a56de428dc520816b19e74d4df /fs/jffs2
parent19e729a928172103e101ffd0829fd13e68c13f78 (diff)
JFFS2 Fix of panics caused by wrong condition for hole frag creation in write_begin
This fixes a regression introduced in commit 205c109a7a96d9a3d8ffe64c4068b70811fef5e8 when switching to write_begin/write_end operations in JFFS2. The page offset is miscalculated, leading to corruption of the fragment lists and subsequently to memory corruption and panics. [ Side note: the bug is a fairly direct result of the naming. Nick was likely misled by the use of "offs", since we tend to use the notion of "offset" not as an absolute position, but as an offset _within_ a page or allocation. Alternatively, a "pgoff_t" is a page index, but not a byte offset - our VM naming can be a bit confusing. So in this case, a VM person would likely have called this a "pos", not an "offs", or perhaps talked about byte offsets rather than page offsets (since it's counted in bytes, not pages). - Linus ] Signed-off-by: Alexey Korolev <akorolev@infradead.org> Signed-off-by: Vasiliy Leonenko <vasiliy.leonenko@mail.ru> Signed-off-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/jffs2')
-rw-r--r--fs/jffs2/file.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index f9c5dd6f4b64..dcc2734e0b5d 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -129,7 +129,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
129 struct inode *inode = mapping->host; 129 struct inode *inode = mapping->host;
130 struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); 130 struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
131 pgoff_t index = pos >> PAGE_CACHE_SHIFT; 131 pgoff_t index = pos >> PAGE_CACHE_SHIFT;
132 uint32_t pageofs = pos & (PAGE_CACHE_SIZE - 1); 132 uint32_t pageofs = index << PAGE_CACHE_SHIFT;
133 int ret = 0; 133 int ret = 0;
134 134
135 pg = __grab_cache_page(mapping, index); 135 pg = __grab_cache_page(mapping, index);