From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2B49C77B72 for ; Wed, 12 Apr 2023 07:39:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229633AbjDLHjy (ORCPT ); Wed, 12 Apr 2023 03:39:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229469AbjDLHjc (ORCPT ); Wed, 12 Apr 2023 03:39:32 -0400 Received: from relay11.mail.gandi.net (relay11.mail.gandi.net [217.70.178.231]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E26DD2 for ; Wed, 12 Apr 2023 00:39:30 -0700 (PDT) Received: (Authenticated sender: miquel.raynal@bootlin.com) by mail.gandi.net (Postfix) with ESMTPSA id C7053100018; Wed, 12 Apr 2023 07:39:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1681285168; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=17BPQPrbGfoG/9Y+BnpABrCjBoUgqhojyRjXMZSD+8c=; b=PfRltgJ1Ic+5NX5hMrhg2PjLHxVBR8qIDRKeEQUmT9+oRHTMJXbAourYqKl0z5uG6K6TuD DcbxHoMVNnY3Jaol01OwcUCkcakHD+Glp6SQ22R2TPCE/9hINgQfScuE3msXJb6Oh7Xp4P owEbhQEurMr67d639FR00rh9BlpPievAzMuoB08vtA3/wG/Fzy4Cs3uW1hTpo0kSe5Jyw7 s5zTNYiRtFxhVC9GlMqR0idX7pLB09VCPy9d06roQ5swBkAHoUb2jJARoVWH4n8elGKeFh WT7MW9yG9I2DFhK9bjqwgwms9dnr1Zx+Y1XIcGWbqYGXb+jR7fC+eIl9mO/n6g== Date: Wed, 12 Apr 2023 09:39:25 +0200 From: Miquel Raynal To: Arseniy Krasnov Cc: Liang Yang , Richard Weinberger , Vignesh Raghavendra , Neil Armstrong , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Yixun Lan , Jianxin Pan , , , , , , Subject: Re: [PATCH v1 3/5] mtd: rawnand: meson: check buffer length Message-ID: <20230412093925.4718ac6f@xps-13> In-Reply-To: <20230412061700.1492474-4-AVKrasnov@sberdevices.ru> References: <20230412061700.1492474-1-AVKrasnov@sberdevices.ru> <20230412061700.1492474-4-AVKrasnov@sberdevices.ru> Organization: Bootlin X-Mailer: Claws Mail 4.0.0 (GTK+ 3.24.33; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Arseniy, AVKrasnov@sberdevices.ru wrote on Wed, 12 Apr 2023 09:16:57 +0300: > With this chip, buffer length is limited by hardware, so check it before > command execution to avoid length trim. What is "this chip"? Are you talking about the controller itself? Is there any specific SoC version targeted? >=20 > Signed-off-by: Arseniy Krasnov > --- > drivers/mtd/nand/raw/meson_nand.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) >=20 > diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/mes= on_nand.c > index 45b53d420aed..f84a10238e4d 100644 > --- a/drivers/mtd/nand/raw/meson_nand.c > +++ b/drivers/mtd/nand/raw/meson_nand.c > @@ -543,6 +543,9 @@ static int meson_nfc_read_buf(struct nand_chip *nand,= u8 *buf, int len) > u32 cmd; > u8 *info; > =20 > + if (len > NFC_CMD_RAW_LEN) > + return -EINVAL; > + > info =3D kzalloc(PER_INFO_BYTE, GFP_KERNEL); > if (!info) > return -ENOMEM; > @@ -571,6 +574,9 @@ static int meson_nfc_write_buf(struct nand_chip *nand= , u8 *buf, int len) > int ret =3D 0; > u32 cmd; > =20 > + if (len > NFC_CMD_RAW_LEN) > + return -EINVAL; > + > ret =3D meson_nfc_dma_buffer_setup(nand, buf, len, NULL, > 0, DMA_TO_DEVICE); > if (ret) > @@ -1269,6 +1275,7 @@ static int meson_nand_attach_chip(struct nand_chip = *nand) > struct meson_nfc_nand_chip *meson_chip =3D to_meson_nand(nand); > struct mtd_info *mtd =3D nand_to_mtd(nand); > int nsectors =3D mtd->writesize / 1024; > + int raw_writesize; > int ret; > =20 > if (!mtd->name) { > @@ -1280,6 +1287,13 @@ static int meson_nand_attach_chip(struct nand_chip= *nand) > return -ENOMEM; > } > =20 > + raw_writesize =3D mtd->writesize + mtd->oobsize; > + if (raw_writesize > NFC_CMD_RAW_LEN) { > + dev_err(nfc->dev, "too big write size in raw mode: %d > %ld\n", > + raw_writesize, NFC_CMD_RAW_LEN); > + return -EINVAL; > + } > + > if (nand->bbt_options & NAND_BBT_USE_FLASH) > nand->bbt_options |=3D NAND_BBT_NO_OOB; > =20 Thanks, Miqu=C3=A8l