From: Boris Brezillon <bbrezillon@kernel.org>
To: Christian Lamparter <chunkeey@gmail.com>, linux-mtd@lists.infradead.org
Cc: Boris Brezillon <boris.brezillon@bootlin.com>,
Richard Weinberger <richard@nod.at>,
Marek Vasut <marek.vasut@gmail.com>,
Abhishek Sahu <absahu@codeaurora.org>,
Miquel Raynal <miquel.raynal@bootlin.com>,
Brian Norris <computersforpeace@gmail.com>,
David Woodhouse <dwmw2@infradead.org>
Subject: Re: mtd: rawnand: qcom: fix memory corruption that causes panic
Date: Tue, 8 Jan 2019 17:14:58 +0100 [thread overview]
Message-ID: <20190108161458.25513-1-bbrezillon@kernel.org> (raw)
In-Reply-To: <20181223003126.1704-1-chunkeey@gmail.com>
From: Boris Brezillon <boris.brezillon@bootlin.com>
On Sun, 2018-12-23 at 00:31:26 UTC, Christian Lamparter wrote:
> This patch fixes a memory corruption that occurred in the
> qcom-nandc driver since it was converted to nand_scan().
>
> On boot, an affected device will panic from a NPE at a weird place:
> | Unable to handle kernel NULL pointer dereference at virtual address 0
> | pgd = (ptrval)
> | [00000000] *pgd=00000000
> | Internal error: Oops: 80000005 [#1] SMP ARM
> | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
> | Hardware name: Generic DT based system
> | PC is at (null)
> | LR is at nand_block_isbad+0x90/0xa4
> | pc : [<00000000>] lr : [<c0592240>] psr: 80000013
> | sp : cf839d40 ip : 00000000 fp : cfae9e20
> | r10: cf815810 r9 : 00000000 r8 : 00000000
> | r7 : 00000000 r6 : 00000000 r5 : 00000001 r4 : cf815810
> | r3 : 00000000 r2 : cfae9810 r1 : ffffffff r0 : cf815810
> | Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
> | Control: 10c5387d Table: 8020406a DAC: 00000051
> | Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
> | [<c0592240>] (nand_block_isbad) from [<c0580a94>]
> | [<c0580a94>] (allocate_partition) from [<c05811e4>]
> | [<c05811e4>] (add_mtd_partitions) from [<c0581164>]
> | [<c0581164>] (parse_mtd_partitions) from [<c057def4>]
> | [<c057def4>] (mtd_device_parse_register) from [<c059d274>]
> | [<c059d274>] (qcom_nandc_probe) from [<c0567f00>]
>
> The problem is that the nand_scan()'s qcom_nand_attach_chip callback
> is updating the nandc->max_cwperpage from 1 to 4. This causes the
> sg_init_table of clear_bam_transaction() in the driver's
> qcom_nandc_block_bad() to memset much more than what was initially
> allocated by alloc_bam_transaction().
>
> This patch restores the old behavior by reallocating the shared bam
> transaction alloc_bam_transaction() after the chip was identified,
> but before mtd_device_parse_register() (which is an alias for
> mtd_device_register() - see panic) gets called. This fixes the
> corruption and the driver is working again.
>
> Cc: stable@vger.kernel.org
> Fixes: 6a3cec64f18c ("mtd: rawnand: qcom: convert driver to nand_scan()")
> Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
> Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
Applied to http://git.infradead.org/linux-mtd.git mtd/fixes, thanks.
Boris
prev parent reply other threads:[~2019-01-08 16:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-23 0:31 [PATCH] mtd: rawnand: qcom: fix memory corruption that causes panic Christian Lamparter
2019-01-08 11:01 ` Miquel Raynal
2019-01-08 16:14 ` Boris Brezillon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190108161458.25513-1-bbrezillon@kernel.org \
--to=bbrezillon@kernel.org \
--cc=absahu@codeaurora.org \
--cc=boris.brezillon@bootlin.com \
--cc=chunkeey@gmail.com \
--cc=computersforpeace@gmail.com \
--cc=dwmw2@infradead.org \
--cc=linux-mtd@lists.infradead.org \
--cc=marek.vasut@gmail.com \
--cc=miquel.raynal@bootlin.com \
--cc=richard@nod.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.