Patch (repost): cramfs memory corruption fix

[Adam J. Richter]

--+HP7ph2BbKc20aGI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

>From: "David L. Parsley" <[e-mail]>
>
>Using root=/dev/ram0 and a cramfs initrd gives me 'wrong magic' when it
>tries to boot.  Even more bizarre, if cramfs is compiled in the kernel
>when I use a romfs root, it says 'wrong magic' then mounts the romfs but
>can't find init.  If I take cramfs out of the kernel, the romfs mounts &
>init runs fine.  I just saw this with ac3.
>
>ramfs croaks with 'kernel BUG in filemap.c line 2559' anytime I make a
>file in ac2 and ac3.  Works fine in 2.4.0 vanilla.  Should be quite
>repeatable...

	This sounds like a bug that I posted a fix for a long time ago.
cramfs calls bforget on the superblock area, destroying that block of
the ramdisk, even when the ramdisk does not contain a cramfs file system.
Normally, bforget is called on block that really can be trashed,
such as blocks release by truncate or unlink.  If it worked for
you before, you were just getting lucky.  Here is the patch.

	Linus, please consider applying this.  Thank you.

	By the way, the other approach to fixing this problem would
be to change bforget not to trash blocks marked with BH_Protected
(I think that is just ramdisk blocks), but that would waste memory,
because we really can release blocks from things like truncating
or unlinking files.

-- 
Adam J. Richter     __     ______________   4880 Stevens Creek Blvd, Suite 104
[e-mail]     \ /                  San Jose, California 95129-1034
[phone]         | g g d r a s i l   United States of America
fax [phone]      "Free Software For The Rest Of Us."

--+HP7ph2BbKc20aGI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=diffs

--- /tmp/adam/linux-2.4.0/fs/cramfs/inode.c	Fri Dec 29 14:07:57 2000
+++ linux/fs/cramfs/inode.c	Sat Dec 30 02:12:06 2000
@@ -138,7 +138,7 @@
 		struct buffer_head * bh = bh_array[i];
 		if (bh) {
 			memcpy(data, bh->b_data, PAGE_CACHE_SIZE);
-			bforget(bh);
+			brelse(bh);
 		} else
 			memset(data, 0, PAGE_CACHE_SIZE);
 		data += PAGE_CACHE_SIZE;

--+HP7ph2BbKc20aGI--