My email got refused because it contained HTML. Here again:

Crashes in ext2 and ext3 filesystem:

John's dump shows that PC was in ext2_find_entry while it crashed. I had exactly the same type of OOPS with ext3_find_entry and found it was actually in the static function ext3_dx_find_entry, which was inlined by the compiler. There it got stuck because of an invalid rec_len, which made the pointer decrease (wrap around) in stead of increase.

And so, ext3 looks as vulnerable as ext2, because in both drivers this iteration sometimes takes place without checking the validity of data read from the SD-card.

Whatever data the Atmel driver delivers, I think it should be checked, also for rec_len values that cause a wrap-around of the pointer. Now that I have it checked it more thoroughly, my NGW100 boots and runs perfect from an SD-card.

Hein Tibosch

John Voltz wrote:
> I believe this might be what he is talking about. I had to reformat my SD card to ext3 to use 2.6.23/24
> John
> Oops: Unhandled exception in kernel mode, sig: 7 [#1]
> PREEMPT FRAME_POINTER chip: 0x01f:0x1e82 rev 2
> Modules linked in: snd_pcm_oss snd_mixer_oss snd_atmel_ac97 snd_ac97_codec =
> snd_pcm snd_timer snd soundcore snd_page_alloc ac97_bus
> PC is at ext2_find_entry+0x9c/0x16c

Haavard Skinnemoen wrote:

(Adding the ext2/ext3/ext4 list to Cc)

Note that the MMC/SD card driver in question, atmel-mci, is not in
mainline, and may be the real cause of this problem. But it looks like
there might be a potential problem in the ext3 code as well?


On Thu, 21 Feb 2008 14:17:04 +0800
Hein_Tibosch <[EMAIL PROTECTED]> wrote:

Hi James,

I've had all kinds of problems with the SD-card hooked to an NGW100, just as 
John Voltz reported earlier:

I debugged this problem and my conclusion is: using an SD-card may lead to both 
BUS-errors and a complete hanging of the system, with 2.6.23.atmel.5 as well as 

Both the driver for ext2 and ext3 are using this type of function to iterate 
through a array of inodes:

    static inline ext2_dirent *ext2_next_entry(ext2_dirent *p)
        return (ext2_dirent *)((char*)p + le16_to_cpu(p->rec_len));

    static inline struct ext3_dir_entry_2 *
        ext3_next_entry(struct ext3_dir_entry_2 *p)
        return (struct ext3_dir_entry_2 *)((char *)p +

Sometimes, rec_len is checked for a zero-value, sometimes the entry is checked 
thoroughly for validity (like with ext2_check_page() or 
ext3_check_dir_entry()), but in other cases rec_len isn't checked at all! This 
is the case in e.g. fs/ext3/namei.c, function ext3_dx_find_entry(). This 
function is always enabled since 2.6.24 (CONFIG_EXT3_INDEX not used anymore).

I had a card on which at one place rec_len turned out to be a small negative 
number. When iterating, it would either cycle for ever (until WDT) or it could 
enter invalid memory (OOPS: BUS error).

( strange though that the rec_len appeared to have a negative number, I just did a 
"mkfs -t ext3" on Ubuntu. Could that be caused by the Atmel-driver? )

I don't yet feel qualified to make a patch for this, I only did it for myself. 
Maybe someone can pick this up: a validity check should be made before any call 
to xxx_next_entry().


Hein Tibosch (HeinBali at avr32linux)

James Stewart wrote:
I'm wondering if there are any known issues with booting from SD card on the ATNGW100 using this kernel. I get a bunch of ext2 looking errors and then a stack dump immediately after mounting VFS. 2.6.23.atmel.5 runs perfectly, however. This is just compiling using atngw100_defconfig. Thanks, James


Kernel mailing list

To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to