• Christian Lamparter's avatar
    mtd: rawnand: qcom: fix memory corruption that causes panic · 81d9bdf5
    Christian Lamparter authored
    This patch fixes a memory corruption that occurred in the
    qcom-nandc driver since it was converted to nand_scan().
    
    On boot, an affected device will panic from a NPE at a weird place:
    | Unable to handle kernel NULL pointer dereference at virtual address 0
    | pgd = (ptrval)
    | [00000000] *pgd=00000000
    | Internal error: Oops: 80000005 [#1] SMP ARM
    | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
    | Hardware name: Generic DT based system
    | PC is at   (null)
    | LR is at nand_block_isbad+0x90/0xa4
    | pc : [<00000000>]    lr : [<c0592240>]    psr: 80000013
    | sp : cf839d40  ip : 00000000  fp : cfae9e20
    | r10: cf815810  r9 : 00000000  r8 : 00000000
    | r7 : 00000000  r6 : 00000000  r5 : 00000001  r4 : cf815810
    | r3 : 00000000  r2 : cfae9810  r1 : ffffffff  r0 : cf815810
    | Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    | Control: 10c5387d  Table: 8020406a  DAC: 00000051
    | Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
    | [<c0592240>] (nand_block_isbad) from [<c0580a94>]
    | [<c0580a94>] (allocate_partition) from [<c05811e4>]
    | [<c05811e4>] (add_mtd_partitions) from [<c0581164>]
    | [<c0581164>] (parse_mtd_partitions) from [<c057def4>]
    | [<c057def4>] (mtd_device_parse_register) from [<c059d274>]
    | [<c059d274>] (qcom_nandc_probe) from [<c0567f00>]
    
    The problem is that the nand_scan()'s qcom_nand_attach_chip callback
    is updating the nandc->max_cwperpage from 1 to 4. This causes the
    sg_init_table of clear_bam_transaction() in the driver's
    qcom_nandc_block_bad() to memset much more than what was initially
    allocated by alloc_bam_transaction().
    
    This patch restores the old behavior by reallocating the shared bam
    transaction alloc_bam_transaction() after the chip was identified,
    but before mtd_device_parse_register() (which is an alias for
    mtd_device_register() - see panic) gets called. This fixes the
    corruption and the driver is working again.
    
    Cc: stable@vger.kernel.org
    Fixes: 6a3cec64 ("mtd: rawnand: qcom: convert driver to nand_scan()")
    Signed-off-by: default avatarChristian Lamparter <chunkeey@gmail.com>
    Acked-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: default avatarBoris Brezillon <bbrezillon@kernel.org>
    81d9bdf5
Name
Last commit
Last update
..
chips Loading commit data...
devices Loading commit data...
lpddr Loading commit data...
maps Loading commit data...
nand Loading commit data...
parsers Loading commit data...
spi-nor Loading commit data...
tests Loading commit data...
ubi Loading commit data...
Kconfig Loading commit data...
Makefile Loading commit data...
afs.c Loading commit data...
ar7part.c Loading commit data...
bcm47xxpart.c Loading commit data...
bcm63xxpart.c Loading commit data...
cmdlinepart.c Loading commit data...
ftl.c Loading commit data...
inftlcore.c Loading commit data...
inftlmount.c Loading commit data...
mtd_blkdevs.c Loading commit data...
mtdblock.c Loading commit data...
mtdblock_ro.c Loading commit data...
mtdchar.c Loading commit data...
mtdconcat.c Loading commit data...
mtdcore.c Loading commit data...
mtdcore.h Loading commit data...
mtdoops.c Loading commit data...
mtdpart.c Loading commit data...
mtdsuper.c Loading commit data...
mtdswap.c Loading commit data...
nftlcore.c Loading commit data...
nftlmount.c Loading commit data...
ofpart.c Loading commit data...
rfd_ftl.c Loading commit data...
sm_ftl.c Loading commit data...
sm_ftl.h Loading commit data...
ssfdc.c Loading commit data...