openwrtv3/target/linux/generic-2.6/patches-2.6.21/212-block2mtd_erase_scan.patch

--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -112,7 +112,7 @@ static int _block2mtd_erase(struct block
 		if (IS_ERR(page))
 			return PTR_ERR(page);
 
-		max = (u_long*)page_address(page) + PAGE_SIZE;
+		max = (u_long*) ((u8 *) page_address(page) + PAGE_SIZE);
 		for (p=(u_long*)page_address(page); p<max; p++)
 			if (*p != -1UL) {
 				lock_page(page);
generic-2.6/2.6.21: refresh patches SVN-Revision: 14453 2009-02-08 19:33:57 +00:00			`--- a/drivers/mtd/devices/block2mtd.c`
			`+++ b/drivers/mtd/devices/block2mtd.c`
refresh generic 2.6.21 patches SVN-Revision: 11185 2008-05-18 20:23:20 +00:00			`@@ -112,7 +112,7 @@ static int _block2mtd_erase(struct block`
Finally fix the pesky x86-2.6 block2mtd related crash (#1058) When erasing blocks, block2mtd checks the block on the physical disk to see if everything's filled with 0xff. When grabbing a page from the page cache, it initializes the limit as <start address> + PAGE_SIZE. Turns out that the pointer to the status page is (unsigned long ), and thus it adds (PAGE_SIZE 4). This would never have been caught, if it wasn't for the unlikely event that block2mtd catches the last page available in the system ram and thus tries to scan 4 memory pages from there. The absolutely trivial fix is to do a double cast (cast to (u8 ), add PAGE_SIZE, then cast to (unsigned long )) ... and there was much rejoicing SVN-Revision: 6318 2007-02-18 13:52:14 +00:00			`if (IS_ERR(page))`
			`return PTR_ERR(page);`

			`- max = (u_long*)page_address(page) + PAGE_SIZE;`
			`+ max = (u_long) ((u8 ) page_address(page) + PAGE_SIZE);`
			`for (p=(u_long*)page_address(page); p<max; p++)`
			`if (*p != -1UL) {`
			`lock_page(page);`