From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail.kernel.org ([198.145.29.99])
 by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux))
 id 1ggu1z-0003Vv-2p
 for linux-mtd@lists.infradead.org; Tue, 08 Jan 2019 16:15:08 +0000
From: Boris Brezillon <bbrezillon@kernel.org>
To: Christian Lamparter <chunkeey@gmail.com>,
	linux-mtd@lists.infradead.org
Cc: Boris Brezillon <boris.brezillon@bootlin.com>,
 Richard Weinberger <richard@nod.at>, Marek Vasut <marek.vasut@gmail.com>,
 Abhishek Sahu <absahu@codeaurora.org>,
 Miquel Raynal <miquel.raynal@bootlin.com>,
 Brian Norris <computersforpeace@gmail.com>,
 David Woodhouse <dwmw2@infradead.org>
Subject: Re: mtd: rawnand: qcom: fix memory corruption that causes panic
Date: Tue,  8 Jan 2019 17:14:58 +0100
Message-Id: <20190108161458.25513-1-bbrezillon@kernel.org>
In-Reply-To: <20181223003126.1704-1-chunkeey@gmail.com>
List-Id: Linux MTD discussion mailing list <linux-mtd.lists.infradead.org>
List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-mtd>,
 <mailto:linux-mtd-request@lists.infradead.org?subject=unsubscribe>
List-Archive: <http://lists.infradead.org/pipermail/linux-mtd/>
List-Post: <mailto:linux-mtd@lists.infradead.org>
List-Help: <mailto:linux-mtd-request@lists.infradead.org?subject=help>
List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-mtd>,
 <mailto:linux-mtd-request@lists.infradead.org?subject=subscribe>

From: Boris Brezillon <boris.brezillon@bootlin.com>

On Sun, 2018-12-23 at 00:31:26 UTC, Christian Lamparter wrote:
> This patch fixes a memory corruption that occurred in the
> qcom-nandc driver since it was converted to nand_scan().
> 
> On boot, an affected device will panic from a NPE at a weird place:
> | Unable to handle kernel NULL pointer dereference at virtual address 0
> | pgd = (ptrval)
> | [00000000] *pgd=00000000
> | Internal error: Oops: 80000005 [#1] SMP ARM
> | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
> | Hardware name: Generic DT based system
> | PC is at   (null)
> | LR is at nand_block_isbad+0x90/0xa4
> | pc : [<00000000>]    lr : [<c0592240>]    psr: 80000013
> | sp : cf839d40  ip : 00000000  fp : cfae9e20
> | r10: cf815810  r9 : 00000000  r8 : 00000000
> | r7 : 00000000  r6 : 00000000  r5 : 00000001  r4 : cf815810
> | r3 : 00000000  r2 : cfae9810  r1 : ffffffff  r0 : cf815810
> | Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
> | Control: 10c5387d  Table: 8020406a  DAC: 00000051
> | Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
> | [<c0592240>] (nand_block_isbad) from [<c0580a94>]
> | [<c0580a94>] (allocate_partition) from [<c05811e4>]
> | [<c05811e4>] (add_mtd_partitions) from [<c0581164>]
> | [<c0581164>] (parse_mtd_partitions) from [<c057def4>]
> | [<c057def4>] (mtd_device_parse_register) from [<c059d274>]
> | [<c059d274>] (qcom_nandc_probe) from [<c0567f00>]
> 
> The problem is that the nand_scan()'s qcom_nand_attach_chip callback
> is updating the nandc->max_cwperpage from 1 to 4. This causes the
> sg_init_table of clear_bam_transaction() in the driver's
> qcom_nandc_block_bad() to memset much more than what was initially
> allocated by alloc_bam_transaction().
> 
> This patch restores the old behavior by reallocating the shared bam
> transaction alloc_bam_transaction() after the chip was identified,
> but before mtd_device_parse_register() (which is an alias for
> mtd_device_register() - see panic) gets called. This fixes the
> corruption and the driver is working again.
> 
> Cc: stable@vger.kernel.org
> Fixes: 6a3cec64f18c ("mtd: rawnand: qcom: convert driver to nand_scan()")
> Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
> Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>

Applied to http://git.infradead.org/linux-mtd.git mtd/fixes, thanks.

Boris