Date:	Fri, 22 Feb 2008 01:45:41 +0800
From:	Hein_Tibosch <hein_tibosch@...oo.es>
To:	James Stewart <jstewart@...adici.com>
CC:	kernel@...32linux.org, linux-ext4@...r.kernel.org
Subject: Re: Linux 2.6.24.atmel.1 MMC/SD

My email got refused because it contained HTML. Here again:

Crashes in ext2 and ext3 filesystem:

John's dump shows that PC was in ext2_find_entry while it crashed. I had 
exactly the same type of OOPS with ext3_find_entry and found it was 
actually in the static function ext3_dx_find_entry, which was inlined by 
the compiler. There it got stuck because of an invalid rec_len, which 
made the pointer decrease (wrap around) in stead of increase.

And so, ext3 looks as vulnerable as ext2, because in both drivers this 
iteration sometimes takes place without checking the validity of data 
read from the SD-card.

Whatever data the Atmel driver delivers, I think it should be checked, 
also for rec_len values that cause a wrap-around of the pointer. Now 
that I have it checked it more thoroughly, my NGW100 boots and runs 
perfect from an SD-card.


Hein Tibosch



John Voltz wrote:
 > I believe this might be what he is talking about. I had to reformat 
my SD card to ext3 to use 2.6.23/24
 >
 > John
 >
 > Oops: Unhandled exception in kernel mode, sig: 7 [#1]
 > PREEMPT FRAME_POINTER chip: 0x01f:0x1e82 rev 2
 > Modules linked in: snd_pcm_oss snd_mixer_oss snd_atmel_ac97 
snd_ac97_codec =
 > snd_pcm snd_timer snd soundcore snd_page_alloc ac97_bus
 > PC is at ext2_find_entry+0x9c/0x16c

Haavard Skinnemoen wrote:

> (Adding the ext2/ext3/ext4 list to Cc)
>
> Note that the MMC/SD card driver in question, atmel-mci, is not in
> mainline, and may be the real cause of this problem. But it looks like
> there might be a potential problem in the ext3 code as well?
>
> Haavard
>
> On Thu, 21 Feb 2008 14:17:04 +0800
> Hein_Tibosch <hein_tibosch@...oo.es> wrote:
>
>   
>> Hi James,
>>
>>
>> I've had all kinds of problems with the SD-card hooked to an NGW100, just as John Voltz reported earlier:
>>
>>     http://www.avr32linux.org/archives/kernel/2007-November/000421.html
>>     http://www.avr32linux.org/archives/kernel/2007-November/000425.html
>>
>> I debugged this problem and my conclusion is: using an SD-card may lead to both BUS-errors and a complete hanging of the system, with 2.6.23.atmel.5 as well as 2.6.24.atmel.1.
>>
>> Both the driver for ext2 and ext3 are using this type of function to iterate through a array of inodes:
>>
>>     static inline ext2_dirent *ext2_next_entry(ext2_dirent *p)
>>     {
>>         return (ext2_dirent *)((char*)p + le16_to_cpu(p->rec_len));
>>     }
>>
>>     static inline struct ext3_dir_entry_2 *
>>         ext3_next_entry(struct ext3_dir_entry_2 *p)
>>     {
>>         return (struct ext3_dir_entry_2 *)((char *)p +
>>             ext3_rec_len_from_disk(p->rec_len));
>>     }
>>
>>
>> Sometimes, rec_len is checked for a zero-value, sometimes the entry is checked thoroughly for validity (like with ext2_check_page() or ext3_check_dir_entry()), but in other cases rec_len isn't checked at all! This is the case in e.g. fs/ext3/namei.c, function ext3_dx_find_entry(). This function is always enabled since 2.6.24 (CONFIG_EXT3_INDEX not used anymore).
>>
>> I had a card on which at one place rec_len turned out to be a small negative number. When iterating, it would either cycle for ever (until WDT) or it could enter invalid memory (OOPS: BUS error).
>>
>> ( strange though that the rec_len appeared to have a negative number, I just did a "mkfs -t ext3" on Ubuntu. Could that be caused by the Atmel-driver? )
>>
>> I don't yet feel qualified to make a patch for this, I only did it for myself. Maybe someone can pick this up: a validity check should be made before any call to xxx_next_entry().
>>
>>
>> Regards,
>>
>> Hein Tibosch (HeinBali at avr32linux)
>>
>>
>>
>> James Stewart wrote:
>> Hi,
>>  
>> I'm wondering if there are any known issues with booting from SD card on the ATNGW100 using this kernel. I get a bunch of ext2 looking errors and then a stack dump immediately after mounting VFS. 2.6.23.atmel.5 runs perfectly, however.
>>  
>> This is just compiling using atngw100_defconfig.
>>  
>> Thanks,
>>  
>> James
>>
>> ------------------------------------------------
>>
>> _______________________________________________
>> Kernel mailing list
>> Kernel@...32linux.org
>> http://duppen.flaskehals.net/cgi-bin/mailman/listinfo/kernel
>>   
>>     
>
>   
-
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists