[PATCH] mtd: mtdram: check offs and len in mtdram->erase

[PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Dongsheng Yang]

We should prevent user to erasing mtd device with
an unaligned offset or length.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
---
 drivers/mtd/devices/mtdram.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index 8e28508..73fa297 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -32,8 +32,29 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB");
 // We could store these in the mtd structure, but we only support 1 device..
 static struct mtd_info *mtd_info;
 
+static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+	int ret = 0;
+
+	/* Start address must align on block boundary */
+	if (ofs % mtd->erasesize) {
+		pr_debug("%s: unaligned address\n", __func__);
+		ret = -EINVAL;
+	}
+
+	/* Length must align on block boundary */
+	if (len % mtd->erasesize) {
+		pr_debug("%s: length not block aligned\n", __func__);
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
+	if (check_offs_len(mtd, instr->addr, instr->len))
+		return -EINVAL;
 	memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
 	instr->state = MTD_ERASE_DONE;
 	mtd_erase_callback(instr);
-- 
1.8.4.2

[PATCH 1/2] mtd: test: refactor mtdtest_erase_eraseblock to introduce a new mtdtest_erase function

[Dongsheng Yang]

In original mtd_test, there is only one function to erase a block, but
we need a function to accept [addr, size] to erase mtd device for
mtd_erasetest. So refactor the original mtdtest_erase_eraseblock
to introduce a new mtdtest_erase.

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
---
 drivers/mtd/tests/mtd_test.c | 44 ++++++++++++++++++++++++++++++++------------
 drivers/mtd/tests/mtd_test.h |  1 +
 2 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/drivers/mtd/tests/mtd_test.c b/drivers/mtd/tests/mtd_test.c
index 34736bb..4c4320c 100644
--- a/drivers/mtd/tests/mtd_test.c
+++ b/drivers/mtd/tests/mtd_test.c
@@ -9,24 +9,14 @@
 int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum)
 {
 	int err;
-	struct erase_info ei;
 	loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
-	memset(&ei, 0, sizeof(struct erase_info));
-	ei.mtd  = mtd;
-	ei.addr = addr;
-	ei.len  = mtd->erasesize;
-
-	err = mtd_erase(mtd, &ei);
+	err = mtdtest_erase(mtd, addr, mtd->erasesize, 0);
 	if (err) {
-		pr_info("error %d while erasing EB %d\n", err, ebnum);
+		pr_info("failed to erase EB %d\n", ebnum);
 		return err;
 	}
 
-	if (ei.state == MTD_ERASE_FAILED) {
-		pr_info("some erase error occurred at EB %d\n", ebnum);
-		return -EIO;
-	}
 	return 0;
 }
 
@@ -111,3 +101,33 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size,
 
 	return err;
 }
+
+/*
+ * There is a parameter named as quiet, it's useful to clean the output
+ * when we are testing some negative cases.
+ */
+int mtdtest_erase(struct mtd_info *mtd, loff_t addr, size_t size, int quiet)
+{
+	int err;
+	struct erase_info ei;
+
+	memset(&ei, 0, sizeof(struct erase_info));
+	ei.mtd  = mtd;
+	ei.addr = addr;
+	ei.len  = size;
+
+	err = mtd_erase(mtd, &ei);
+	if (err) {
+		if (!quiet)
+			pr_err("error %d while erasing (addr: %#llx, size: %lu)\n", err, addr, size);
+		return err;
+	}
+
+	if (ei.state == MTD_ERASE_FAILED) {
+		if (!quiet)
+			pr_err("some erase error occurred in erasing (addr: %#llx, size: %lu)\n", addr, size);
+		return -EIO;
+	}
+
+	return err;
+}
diff --git a/drivers/mtd/tests/mtd_test.h b/drivers/mtd/tests/mtd_test.h
index 4b7bee1..c53558c 100644
--- a/drivers/mtd/tests/mtd_test.h
+++ b/drivers/mtd/tests/mtd_test.h
@@ -21,3 +21,4 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,
 int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf);
 int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size,
 		const void *buf);
+int mtdtest_erase(struct mtd_info *mtd, loff_t addr, size_t size, int quiet);
-- 
1.8.4.2

[PATCH 2/2] mtd: tests: introduce a erase test

[Dongsheng Yang]

This test will test the below cases.

Positive case:
	* erase all good block. (positive case)
Negative case:
	* addr >= mtd size
	* addr + size > mtd size
	* unaligned addr
	* unaligned size

Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
---
 drivers/mtd/tests/Makefile    |   2 +
 drivers/mtd/tests/erasetest.c | 155 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 157 insertions(+)
 create mode 100644 drivers/mtd/tests/erasetest.c

diff --git a/drivers/mtd/tests/Makefile b/drivers/mtd/tests/Makefile
index 937a829..1308b62 100644
--- a/drivers/mtd/tests/Makefile
+++ b/drivers/mtd/tests/Makefile
@@ -1,6 +1,7 @@
 obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o
+obj-$(CONFIG_MTD_TESTS) += mtd_erasetest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o
@@ -11,6 +12,7 @@ obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o
 mtd_oobtest-objs := oobtest.o mtd_test.o
 mtd_pagetest-objs := pagetest.o mtd_test.o
 mtd_readtest-objs := readtest.o mtd_test.o
+mtd_erasetest-objs := erasetest.o mtd_test.o
 mtd_speedtest-objs := speedtest.o mtd_test.o
 mtd_stresstest-objs := stresstest.o mtd_test.o
 mtd_subpagetest-objs := subpagetest.o mtd_test.o
diff --git a/drivers/mtd/tests/erasetest.c b/drivers/mtd/tests/erasetest.c
new file mode 100644
index 0000000..629aa35
--- /dev/null
+++ b/drivers/mtd/tests/erasetest.c
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2015 Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; see the file COPYING. If not, write to the Free Software
+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Check MTD device erase.
+ *
+ * Author: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/err.h>
+#include <linux/mtd/mtd.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+
+#include "mtd_test.h"
+
+static int dev = -EINVAL;
+module_param(dev, int, S_IRUGO);
+MODULE_PARM_DESC(dev, "MTD device number to use");
+
+static struct mtd_info *mtd;
+static unsigned char *bbt;
+
+static int pgsize;
+static int ebcnt;
+static int pgcnt;
+
+static int __init mtd_erasetest_init(void)
+{
+	uint64_t tmp;
+	int err;
+
+	printk(KERN_INFO "\n");
+	printk(KERN_INFO "=================================================\n");
+
+	if (dev < 0) {
+		pr_info("Please specify a valid mtd-device via module parameter\n");
+		return -EINVAL;
+	}
+
+	pr_info("MTD device: %d\n", dev);
+
+	mtd = get_mtd_device(NULL, dev);
+	if (IS_ERR(mtd)) {
+		err = PTR_ERR(mtd);
+		pr_err("error: Cannot get MTD device\n");
+		return err;
+	}
+
+	if (mtd->writesize == 1) {
+		pr_info("not NAND flash, assume page size is 512 "
+		       "bytes.\n");
+		pgsize = 512;
+	} else
+		pgsize = mtd->writesize;
+
+	tmp = mtd->size;
+	do_div(tmp, mtd->erasesize);
+	ebcnt = tmp;
+	pgcnt = mtd->erasesize / pgsize;
+
+	pr_info("MTD device size %llu, eraseblock size %u, "
+	       "page size %u, count of eraseblocks %u, pages per "
+	       "eraseblock %u, OOB size %u\n",
+	       (unsigned long long)mtd->size, mtd->erasesize,
+	       pgsize, ebcnt, pgcnt, mtd->oobsize);
+
+	err = -ENOMEM;
+	bbt = kzalloc(ebcnt, GFP_KERNEL);
+	if (!bbt)
+		goto out;
+	err = mtdtest_scan_for_bad_eraseblocks(mtd, bbt, 0, ebcnt);
+	if (err)
+		goto out;
+
+	/* Case.1 Erase all good eraseblocks */
+	err = mtdtest_erase_good_eraseblocks(mtd, bbt, 0, ebcnt);
+	if (err)
+		goto out;
+
+	/* Case.2 addr >= mtd->size */
+	err = mtdtest_erase(mtd, mtd->size, mtd->erasesize, 1);
+	if (err != -EINVAL) {
+		pr_err("error: erasing (addr = mtd->size = %llu): it return %d, But expected %d.",
+			mtd->size, err, -EINVAL);
+		goto out;
+	}
+
+	/* Case.3 addr + size > mtd->size */
+	err = mtdtest_erase(mtd, mtd->size, mtd->erasesize * 2, 1);
+	if (err != -EINVAL) {
+		pr_err("error: erasing (addr + size = %llu > mtd->size = %llu): it return %d, But expected %d.",
+			mtd->size + mtd->erasesize * 2, mtd->size , err, -EINVAL);
+		goto out;
+	}
+
+	/* Case.4 unaligned addr */
+	err = mtdtest_erase(mtd, mtd->erasesize / 2, mtd->erasesize, 1);
+	if (err != -EINVAL) {
+		pr_err("error: erasing unaligned addr: %llu (erasesize: %u): it return %d, But expected %d.",
+			((loff_t)mtd->erasesize) / 2, mtd->erasesize, err, -EINVAL);
+		goto out;
+	}
+	
+	/* Case.5 unaligned size */
+	err = mtdtest_erase(mtd, mtd->erasesize, mtd->erasesize / 2, 1);
+	if (err != -EINVAL) {
+		pr_err("error: erasing unaligned size: %u (erasesize: %u): it return %d, But expected %d.",
+			mtd->erasesize / 2, mtd->erasesize, err, -EINVAL);
+		goto out;
+	}
+
+	err = 0;
+	if (err)
+		pr_info("finished with errors\n");
+	else
+		pr_info("finished\n");
+
+out:
+
+	kfree(bbt);
+	put_mtd_device(mtd);
+	if (err)
+		pr_info("error %d occurred\n", err);
+	printk(KERN_INFO "=================================================\n");
+	return err;
+}
+module_init(mtd_erasetest_init);
+
+static void __exit mtd_erasetest_exit(void)
+{
+	return;
+}
+module_exit(mtd_erasetest_exit);
+
+MODULE_DESCRIPTION("Erase test module");
+MODULE_AUTHOR("Dongsheng Yang");
+MODULE_LICENSE("GPL");
-- 
1.8.4.2

Re: [PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Brian Norris]

On Tue, Jul 21, 2015 at 04:30:20PM +0800, Dongsheng Yang wrote:
> We should prevent user to erasing mtd device with
> an unaligned offset or length.
> 
> Signed-off-by: Dongsheng Yang <yangds.fnst@cn.fujitsu.com>

Seems reasonable. Pushed to l2-mtd.git.

[PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Sudip Mukherjee]

We should prevent user to erasing mtd device with an unaligned offset
or length.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---

I am not sure if I should add the Signed-off-by of
Dongsheng Yang <yangds.fnst@cn.fujitsu.com> . He is the original author
and he should get the credit for that.

 drivers/mtd/devices/mtdram.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index 8e28508..21b6a05 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -32,8 +32,35 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB");
 // We could store these in the mtd structure, but we only support 1 device..
 static struct mtd_info *mtd_info;
 
+static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+	int ret = 0;
+	uint64_t temp_len, rem;
+
+	/* Start address must align on block boundary */
+	temp_len = ofs;
+	rem = do_div(temp_len, mtd->erasesize);
+	if (rem) {
+		pr_debug("%s: unaligned address\n", __func__);
+		ret = -EINVAL;
+	}
+
+	/* Length must align on block boundary */
+	temp_len = len;
+	rem = do_div(temp_len, mtd->erasesize);
+
+	if (rem) {
+		pr_debug("%s: length not block aligned\n", __func__);
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
+	if (check_offs_len(mtd, instr->addr, instr->len))
+		return -EINVAL;
 	memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
 	instr->state = MTD_ERASE_DONE;
 	mtd_erase_callback(instr);
-- 
1.9.1

Re: [PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Dongsheng Yang]

On 10/01/2015 12:41 AM, Sudip Mukherjee wrote:
> We should prevent user to erasing mtd device with an unaligned offset
> or length.
>
> Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
> ---
>
> I am not sure if I should add the Signed-off-by of
> Dongsheng Yang <yangds.fnst@cn.fujitsu.com> . He is the original author
> and he should get the credit for that.

But I had sent a a patch out to fix this problem before your v1.

http://lists.infradead.org/pipermail/linux-mtd/2015-September/062234.html

Yang
>
>   drivers/mtd/devices/mtdram.c | 27 +++++++++++++++++++++++++++
>   1 file changed, 27 insertions(+)
>
> diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
> index 8e28508..21b6a05 100644
> --- a/drivers/mtd/devices/mtdram.c
> +++ b/drivers/mtd/devices/mtdram.c
> @@ -32,8 +32,35 @@ MODULE_PARM_DESC(erase_size, "Device erase block size in KiB");
>   // We could store these in the mtd structure, but we only support 1 device..
>   static struct mtd_info *mtd_info;
>
> +static int check_offs_len(struct mtd_info *mtd, loff_t ofs, uint64_t len)
> +{
> +	int ret = 0;
> +	uint64_t temp_len, rem;
> +
> +	/* Start address must align on block boundary */
> +	temp_len = ofs;
> +	rem = do_div(temp_len, mtd->erasesize);
> +	if (rem) {
> +		pr_debug("%s: unaligned address\n", __func__);
> +		ret = -EINVAL;
> +	}
> +
> +	/* Length must align on block boundary */
> +	temp_len = len;
> +	rem = do_div(temp_len, mtd->erasesize);
> +
> +	if (rem) {
> +		pr_debug("%s: length not block aligned\n", __func__);
> +		ret = -EINVAL;
> +	}
> +
> +	return ret;
> +}
> +
>   static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
>   {
> +	if (check_offs_len(mtd, instr->addr, instr->len))
> +		return -EINVAL;
>   	memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
>   	instr->state = MTD_ERASE_DONE;
>   	mtd_erase_callback(instr);
>

Re: [PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Sudip Mukherjee]

On Fri, Oct 02, 2015 at 05:39:02PM +0800, Dongsheng Yang wrote:
> On 10/01/2015 12:41 AM, Sudip Mukherjee wrote:
> >We should prevent user to erasing mtd device with an unaligned offset
> >or length.
> >
> >Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
> >---
> >
> >I am not sure if I should add the Signed-off-by of
> >Dongsheng Yang <yangds.fnst@cn.fujitsu.com> . He is the original author
> >and he should get the credit for that.
> 
> But I had sent a a patch out to fix this problem before your v1.
> 
> http://lists.infradead.org/pipermail/linux-mtd/2015-September/062234.html
I didn't know that. I think your v1 was applied.

regards
sudip

Re: [PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Brian Norris]

On Fri, Oct 02, 2015 at 03:31:33PM +0530, Sudip Mukherjee wrote:
> On Fri, Oct 02, 2015 at 05:39:02PM +0800, Dongsheng Yang wrote:
> > On 10/01/2015 12:41 AM, Sudip Mukherjee wrote:
> > >We should prevent user to erasing mtd device with an unaligned offset
> > >or length.
> > >
> > >Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
> > >---
> > >
> > >I am not sure if I should add the Signed-off-by of
> > >Dongsheng Yang <yangds.fnst@cn.fujitsu.com> . He is the original author
> > >and he should get the credit for that.
> > 
> > But I had sent a a patch out to fix this problem before your v1.
> > 
> > http://lists.infradead.org/pipermail/linux-mtd/2015-September/062234.html
> I didn't know that. I think your v1 was applied.

Sorry if I left any confusion. Dongsheng's v1 was applied and reverted.
v2 is still under review (and was sent slightly before (?) your v1).
Feel free to comment there.

Brian

Re: [PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Dongsheng Yang]

On 10/03/2015 01:38 AM, Brian Norris wrote:
> On Fri, Oct 02, 2015 at 03:31:33PM +0530, Sudip Mukherjee wrote:
>> On Fri, Oct 02, 2015 at 05:39:02PM +0800, Dongsheng Yang wrote:
>>> On 10/01/2015 12:41 AM, Sudip Mukherjee wrote:
>>>> We should prevent user to erasing mtd device with an unaligned offset
>>>> or length.
>>>>
>>>> Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
>>>> ---
>>>>
>>>> I am not sure if I should add the Signed-off-by of
>>>> Dongsheng Yang <yangds.fnst@cn.fujitsu.com> . He is the original author
>>>> and he should get the credit for that.
>>>
>>> But I had sent a a patch out to fix this problem before your v1.
>>>
>>> http://lists.infradead.org/pipermail/linux-mtd/2015-September/062234.html
>> I didn't know that. I think your v1 was applied.
>
> Sorry if I left any confusion. Dongsheng's v1 was applied and reverted.
> v2 is still under review (and was sent slightly before (?) your v1).

Yea, sorry I should have mentioned it earlier. But I was and am still
in a vacation, then I did not point it out in time.

Sudip, any comment or test for my patch there is always welcome.

Thanx
Yang
> Feel free to comment there.
>
> Brian
> .
>

Re: [PATCH] mtd: mtdram: check offs and len in mtdram->erase

[Sudip Mukherjee]

On Sat, Oct 03, 2015 at 11:31:04AM +0800, Dongsheng Yang wrote:
> On 10/03/2015 01:38 AM, Brian Norris wrote:
> >On Fri, Oct 02, 2015 at 03:31:33PM +0530, Sudip Mukherjee wrote:
> >>On Fri, Oct 02, 2015 at 05:39:02PM +0800, Dongsheng Yang wrote:
> >>>On 10/01/2015 12:41 AM, Sudip Mukherjee wrote:
> >>>>We should prevent user to erasing mtd device with an unaligned offset
> >>>>or length.
> >>>>
> >>>>Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
> >>>>---
> >>>>
> >>>>I am not sure if I should add the Signed-off-by of
> >>>>Dongsheng Yang <yangds.fnst@cn.fujitsu.com> . He is the original author
> >>>>and he should get the credit for that.
> >>>
> >>>But I had sent a a patch out to fix this problem before your v1.
> >>>
> >>>http://lists.infradead.org/pipermail/linux-mtd/2015-September/062234.html
> >>I didn't know that. I think your v1 was applied.
> >
> >Sorry if I left any confusion. Dongsheng's v1 was applied and reverted.
> >v2 is still under review (and was sent slightly before (?) your v1).
> 
> Yea, sorry I should have mentioned it earlier. But I was and am still
> in a vacation, then I did not point it out in time.
> 
> Sudip, any comment or test for my patch there is always welcome.
Sorry, I donot know anything about this driver to comment. My main patch
was to fix the build failure. And since by that time your patch was
reverted so I sent another path with my patch and your patch combined
together.

regards
sudip