* [PATCH BUGFIX] mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions
@ 2016-09-09 14:44 Lothar Waßmann
2016-09-15 16:06 ` Boris Brezillon
0 siblings, 1 reply; 4+ messages in thread
From: Lothar Waßmann @ 2016-09-09 14:44 UTC (permalink / raw)
To: linux-arm-kernel
commit a894cf6c5a82 ("mtd: nand: mxc: switch to mtd_ooblayout_ops")
introduced a regression accessing the OOB area from the mxc_nand
driver due to an Obiwan error in the mxc_nand_v[12]_ooblayout_free()
functions. They report a bogus oobregion { 64, 7 } which leads to
errors accessing bogus data when reading the oob area.
Prior to the commit the mtd-oobtest module could be run without any
errors. With the offending commit, this test fails with results like:
|Running mtd-oobtest
|
|=================================================
|mtd_oobtest: MTD device: 5
|mtd_oobtest: MTD device size 524288, eraseblock size 131072, page size 2048, count of eraseblocks 4, pages per eraseblock 64, OOB size 64
|mtd_test: scanning for bad eraseblocks
|mtd_test: scanned 4 eraseblocks, 0 are bad
|mtd_oobtest: test 1 of 5
|mtd_oobtest: writing OOBs of whole device
|mtd_oobtest: written up to eraseblock 0
|mtd_oobtest: written 4 eraseblocks
|mtd_oobtest: verifying all eraseblocks
|mtd_oobtest: error @addr[0x0:0x19] 0x9a -> 0x78 diff 0xe2
|mtd_oobtest: error @addr[0x0:0x1a] 0xcc -> 0x0 diff 0xcc
|mtd_oobtest: error @addr[0x0:0x1b] 0xe0 -> 0x85 diff 0x65
|mtd_oobtest: error @addr[0x0:0x1c] 0x60 -> 0x62 diff 0x2
|mtd_oobtest: error @addr[0x0:0x1d] 0x69 -> 0x45 diff 0x2c
|mtd_oobtest: error @addr[0x0:0x1e] 0xcd -> 0xa0 diff 0x6d
|mtd_oobtest: error @addr[0x0:0x1f] 0xf2 -> 0x60 diff 0x92
|mtd_oobtest: error: verify failed at 0x0
[...]
Signed-off-by: Lothar Wa?mann <LW@KARO-electronics.de>
---
drivers/mtd/nand/mxc_nand.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 5173fad..fdee907 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -893,7 +893,7 @@ static int mxc_v1_ooblayout_free(struct mtd_info *mtd, int section,
{
struct nand_chip *nand_chip = mtd_to_nand(mtd);
- if (section > nand_chip->ecc.steps)
+ if (section >= nand_chip->ecc.steps)
return -ERANGE;
if (!section) {
@@ -943,7 +943,7 @@ static int mxc_v2_ooblayout_free(struct mtd_info *mtd, int section,
struct nand_chip *nand_chip = mtd_to_nand(mtd);
int stepsize = nand_chip->ecc.bytes == 9 ? 16 : 26;
- if (section > nand_chip->ecc.steps)
+ if (section >= nand_chip->ecc.steps)
return -ERANGE;
if (!section) {
--
2.1.4
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH BUGFIX] mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions
2016-09-09 14:44 [PATCH BUGFIX] mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions Lothar Waßmann
@ 2016-09-15 16:06 ` Boris Brezillon
2016-09-16 8:09 ` Lothar Waßmann
0 siblings, 1 reply; 4+ messages in thread
From: Boris Brezillon @ 2016-09-15 16:06 UTC (permalink / raw)
To: linux-arm-kernel
Hi Lothar,
On Fri, 9 Sep 2016 16:44:11 +0200
Lothar Wa?mann <LW@KARO-electronics.de> wrote:
> commit a894cf6c5a82 ("mtd: nand: mxc: switch to mtd_ooblayout_ops")
> introduced a regression accessing the OOB area from the mxc_nand
> driver due to an Obiwan error in the mxc_nand_v[12]_ooblayout_free()
> functions. They report a bogus oobregion { 64, 7 } which leads to
> errors accessing bogus data when reading the oob area.
>
> Prior to the commit the mtd-oobtest module could be run without any
> errors. With the offending commit, this test fails with results like:
> |Running mtd-oobtest
> |
> |=================================================
> |mtd_oobtest: MTD device: 5
> |mtd_oobtest: MTD device size 524288, eraseblock size 131072, page size 2048, count of eraseblocks 4, pages per eraseblock 64, OOB size 64
> |mtd_test: scanning for bad eraseblocks
> |mtd_test: scanned 4 eraseblocks, 0 are bad
> |mtd_oobtest: test 1 of 5
> |mtd_oobtest: writing OOBs of whole device
> |mtd_oobtest: written up to eraseblock 0
> |mtd_oobtest: written 4 eraseblocks
> |mtd_oobtest: verifying all eraseblocks
> |mtd_oobtest: error @addr[0x0:0x19] 0x9a -> 0x78 diff 0xe2
> |mtd_oobtest: error @addr[0x0:0x1a] 0xcc -> 0x0 diff 0xcc
> |mtd_oobtest: error @addr[0x0:0x1b] 0xe0 -> 0x85 diff 0x65
> |mtd_oobtest: error @addr[0x0:0x1c] 0x60 -> 0x62 diff 0x2
> |mtd_oobtest: error @addr[0x0:0x1d] 0x69 -> 0x45 diff 0x2c
> |mtd_oobtest: error @addr[0x0:0x1e] 0xcd -> 0xa0 diff 0x6d
> |mtd_oobtest: error @addr[0x0:0x1f] 0xf2 -> 0x60 diff 0x92
> |mtd_oobtest: error: verify failed at 0x0
> [...]
>
> Signed-off-by: Lothar Wa?mann <LW@KARO-electronics.de>
> ---
> drivers/mtd/nand/mxc_nand.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
> index 5173fad..fdee907 100644
> --- a/drivers/mtd/nand/mxc_nand.c
> +++ b/drivers/mtd/nand/mxc_nand.c
> @@ -893,7 +893,7 @@ static int mxc_v1_ooblayout_free(struct mtd_info *mtd, int section,
> {
> struct nand_chip *nand_chip = mtd_to_nand(mtd);
>
> - if (section > nand_chip->ecc.steps)
> + if (section >= nand_chip->ecc.steps)
> return -ERANGE;
Hm, looking at the commit you're pointing to, it seems that this test
is correct (we have X + 1 free sections, where X is the number of ECC
steps).
>
> if (!section) {
> @@ -943,7 +943,7 @@ static int mxc_v2_ooblayout_free(struct mtd_info *mtd, int section,
> struct nand_chip *nand_chip = mtd_to_nand(mtd);
> int stepsize = nand_chip->ecc.bytes == 9 ? 16 : 26;
>
> - if (section > nand_chip->ecc.steps)
> + if (section >= nand_chip->ecc.steps)
> return -ERANGE;
Yep, this one is a real bug.
>
> if (!section) {
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH BUGFIX] mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions
2016-09-15 16:06 ` Boris Brezillon
@ 2016-09-16 8:09 ` Lothar Waßmann
2016-09-19 9:34 ` Boris Brezillon
0 siblings, 1 reply; 4+ messages in thread
From: Lothar Waßmann @ 2016-09-16 8:09 UTC (permalink / raw)
To: linux-arm-kernel
Hi,
On Thu, 15 Sep 2016 18:06:05 +0200 Boris Brezillon wrote:
> Hi Lothar,
>
> On Fri, 9 Sep 2016 16:44:11 +0200
> Lothar Wa?mann <LW@KARO-electronics.de> wrote:
>
> > commit a894cf6c5a82 ("mtd: nand: mxc: switch to mtd_ooblayout_ops")
> > introduced a regression accessing the OOB area from the mxc_nand
> > driver due to an Obiwan error in the mxc_nand_v[12]_ooblayout_free()
> > functions. They report a bogus oobregion { 64, 7 } which leads to
> > errors accessing bogus data when reading the oob area.
> >
> > Prior to the commit the mtd-oobtest module could be run without any
> > errors. With the offending commit, this test fails with results like:
> > |Running mtd-oobtest
> > |
> > |=================================================
> > |mtd_oobtest: MTD device: 5
> > |mtd_oobtest: MTD device size 524288, eraseblock size 131072, page size 2048, count of eraseblocks 4, pages per eraseblock 64, OOB size 64
> > |mtd_test: scanning for bad eraseblocks
> > |mtd_test: scanned 4 eraseblocks, 0 are bad
> > |mtd_oobtest: test 1 of 5
> > |mtd_oobtest: writing OOBs of whole device
> > |mtd_oobtest: written up to eraseblock 0
> > |mtd_oobtest: written 4 eraseblocks
> > |mtd_oobtest: verifying all eraseblocks
> > |mtd_oobtest: error @addr[0x0:0x19] 0x9a -> 0x78 diff 0xe2
> > |mtd_oobtest: error @addr[0x0:0x1a] 0xcc -> 0x0 diff 0xcc
> > |mtd_oobtest: error @addr[0x0:0x1b] 0xe0 -> 0x85 diff 0x65
> > |mtd_oobtest: error @addr[0x0:0x1c] 0x60 -> 0x62 diff 0x2
> > |mtd_oobtest: error @addr[0x0:0x1d] 0x69 -> 0x45 diff 0x2c
> > |mtd_oobtest: error @addr[0x0:0x1e] 0xcd -> 0xa0 diff 0x6d
> > |mtd_oobtest: error @addr[0x0:0x1f] 0xf2 -> 0x60 diff 0x92
> > |mtd_oobtest: error: verify failed at 0x0
> > [...]
> >
> > Signed-off-by: Lothar Wa?mann <LW@KARO-electronics.de>
> > ---
> > drivers/mtd/nand/mxc_nand.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
> > index 5173fad..fdee907 100644
> > --- a/drivers/mtd/nand/mxc_nand.c
> > +++ b/drivers/mtd/nand/mxc_nand.c
> > @@ -893,7 +893,7 @@ static int mxc_v1_ooblayout_free(struct mtd_info *mtd, int section,
> > {
> > struct nand_chip *nand_chip = mtd_to_nand(mtd);
> >
> > - if (section > nand_chip->ecc.steps)
> > + if (section >= nand_chip->ecc.steps)
> > return -ERANGE;
>
> Hm, looking at the commit you're pointing to, it seems that this test
> is correct (we have X + 1 free sections, where X is the number of ECC
> steps).
>
You are right. I didn't verify the v1 case (for which I have no HW here
any more).
I'll send a corrected patch.
Lothar Wa?mann
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH BUGFIX] mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions
2016-09-16 8:09 ` Lothar Waßmann
@ 2016-09-19 9:34 ` Boris Brezillon
0 siblings, 0 replies; 4+ messages in thread
From: Boris Brezillon @ 2016-09-19 9:34 UTC (permalink / raw)
To: linux-arm-kernel
On Fri, 16 Sep 2016 10:09:25 +0200
Lothar Wa?mann <LW@KARO-electronics.de> wrote:
> Hi,
>
> On Thu, 15 Sep 2016 18:06:05 +0200 Boris Brezillon wrote:
> > Hi Lothar,
> >
> > On Fri, 9 Sep 2016 16:44:11 +0200
> > Lothar Wa?mann <LW@KARO-electronics.de> wrote:
> >
> > > commit a894cf6c5a82 ("mtd: nand: mxc: switch to mtd_ooblayout_ops")
> > > introduced a regression accessing the OOB area from the mxc_nand
> > > driver due to an Obiwan error in the mxc_nand_v[12]_ooblayout_free()
> > > functions. They report a bogus oobregion { 64, 7 } which leads to
> > > errors accessing bogus data when reading the oob area.
> > >
> > > Prior to the commit the mtd-oobtest module could be run without any
> > > errors. With the offending commit, this test fails with results like:
> > > |Running mtd-oobtest
> > > |
> > > |=================================================
> > > |mtd_oobtest: MTD device: 5
> > > |mtd_oobtest: MTD device size 524288, eraseblock size 131072, page size 2048, count of eraseblocks 4, pages per eraseblock 64, OOB size 64
> > > |mtd_test: scanning for bad eraseblocks
> > > |mtd_test: scanned 4 eraseblocks, 0 are bad
> > > |mtd_oobtest: test 1 of 5
> > > |mtd_oobtest: writing OOBs of whole device
> > > |mtd_oobtest: written up to eraseblock 0
> > > |mtd_oobtest: written 4 eraseblocks
> > > |mtd_oobtest: verifying all eraseblocks
> > > |mtd_oobtest: error @addr[0x0:0x19] 0x9a -> 0x78 diff 0xe2
> > > |mtd_oobtest: error @addr[0x0:0x1a] 0xcc -> 0x0 diff 0xcc
> > > |mtd_oobtest: error @addr[0x0:0x1b] 0xe0 -> 0x85 diff 0x65
> > > |mtd_oobtest: error @addr[0x0:0x1c] 0x60 -> 0x62 diff 0x2
> > > |mtd_oobtest: error @addr[0x0:0x1d] 0x69 -> 0x45 diff 0x2c
> > > |mtd_oobtest: error @addr[0x0:0x1e] 0xcd -> 0xa0 diff 0x6d
> > > |mtd_oobtest: error @addr[0x0:0x1f] 0xf2 -> 0x60 diff 0x92
> > > |mtd_oobtest: error: verify failed at 0x0
> > > [...]
> > >
> > > Signed-off-by: Lothar Wa?mann <LW@KARO-electronics.de>
> > > ---
> > > drivers/mtd/nand/mxc_nand.c | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
> > > index 5173fad..fdee907 100644
> > > --- a/drivers/mtd/nand/mxc_nand.c
> > > +++ b/drivers/mtd/nand/mxc_nand.c
> > > @@ -893,7 +893,7 @@ static int mxc_v1_ooblayout_free(struct mtd_info *mtd, int section,
> > > {
> > > struct nand_chip *nand_chip = mtd_to_nand(mtd);
> > >
> > > - if (section > nand_chip->ecc.steps)
> > > + if (section >= nand_chip->ecc.steps)
> > > return -ERANGE;
> >
> > Hm, looking at the commit you're pointing to, it seems that this test
> > is correct (we have X + 1 free sections, where X is the number of ECC
> > steps).
> >
> You are right. I didn't verify the v1 case (for which I have no HW here
> any more).
> I'll send a corrected patch.
No need to resend, I fixed it locally.
Thanks,
Boris
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-09-19 9:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-09 14:44 [PATCH BUGFIX] mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions Lothar Waßmann
2016-09-15 16:06 ` Boris Brezillon
2016-09-16 8:09 ` Lothar Waßmann
2016-09-19 9:34 ` Boris Brezillon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).