* [PATCH] mtd: nand: check ecc->total sanity in nand_scan_tail
@ 2017-05-25 4:50 Masahiro Yamada
2017-05-29 18:40 ` Boris Brezillon
0 siblings, 1 reply; 2+ messages in thread
From: Masahiro Yamada @ 2017-05-25 4:50 UTC (permalink / raw)
To: linux-mtd
Cc: Masahiro Yamada, Cyrille Pitchen, linux-kernel, Boris Brezillon,
Marek Vasut, Brian Norris, Richard Weinberger, David Woodhouse
Drivers are supposed to set correct ecc->{size,strength,bytes} before
calling nand_scan_tail(), but it does not complain about ecc->total
bigger than oobsize.
In this case, chip->scan_bbt() crashes due to memory corruption, but
it is hard to debug. It would be kind to fail it earlier with a clear
message.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
---
I was actually hit by this case.
I wasted half a day until I figured out my coding mistake in my
Denali driver. It will be helpful to check this in NAND core.
drivers/mtd/nand/nand_base.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index f4d686192717..14d6a5aa3ee8 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -4970,6 +4970,11 @@ int nand_scan_tail(struct mtd_info *mtd)
goto err_free;
}
ecc->total = ecc->steps * ecc->bytes;
+ if (ecc->total > mtd->oobsize) {
+ WARN(1, "Total number of ECC bytes exceeded oobsize\n");
+ ret = -EINVAL;
+ goto err_free;
+ }
/*
* The number of bytes available for a client to place data into
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] mtd: nand: check ecc->total sanity in nand_scan_tail
2017-05-25 4:50 [PATCH] mtd: nand: check ecc->total sanity in nand_scan_tail Masahiro Yamada
@ 2017-05-29 18:40 ` Boris Brezillon
0 siblings, 0 replies; 2+ messages in thread
From: Boris Brezillon @ 2017-05-29 18:40 UTC (permalink / raw)
To: Masahiro Yamada
Cc: linux-mtd, Marek Vasut, Richard Weinberger, linux-kernel,
Cyrille Pitchen, Brian Norris, David Woodhouse
On Thu, 25 May 2017 13:50:20 +0900
Masahiro Yamada <yamada.masahiro@socionext.com> wrote:
> Drivers are supposed to set correct ecc->{size,strength,bytes} before
> calling nand_scan_tail(), but it does not complain about ecc->total
> bigger than oobsize.
>
> In this case, chip->scan_bbt() crashes due to memory corruption, but
> it is hard to debug. It would be kind to fail it earlier with a clear
> message.
>
> Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Applied to nand/next.
Thanks,
Boris
> ---
>
> I was actually hit by this case.
>
> I wasted half a day until I figured out my coding mistake in my
> Denali driver. It will be helpful to check this in NAND core.
>
>
> drivers/mtd/nand/nand_base.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
> index f4d686192717..14d6a5aa3ee8 100644
> --- a/drivers/mtd/nand/nand_base.c
> +++ b/drivers/mtd/nand/nand_base.c
> @@ -4970,6 +4970,11 @@ int nand_scan_tail(struct mtd_info *mtd)
> goto err_free;
> }
> ecc->total = ecc->steps * ecc->bytes;
> + if (ecc->total > mtd->oobsize) {
> + WARN(1, "Total number of ECC bytes exceeded oobsize\n");
> + ret = -EINVAL;
> + goto err_free;
> + }
>
> /*
> * The number of bytes available for a client to place data into
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-05-29 18:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-25 4:50 [PATCH] mtd: nand: check ecc->total sanity in nand_scan_tail Masahiro Yamada
2017-05-29 18:40 ` Boris Brezillon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox