linux-kernel - Re: [PATCH] mtd: nand: fix bug writing 1 byte less than page size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160718110432.003b52ea@bbrezillon>
Date:	Mon, 18 Jul 2016 11:04:32 +0200
From:	Boris Brezillon <boris.brezillon@...e-electrons.com>
To:	Hector Palacios <hector.palacios@...i.com>
Cc:	<linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
	<richard@....at>, <oss@...error.net>, <stable@...r.kernel.org>,
	Brian Norris <computersforpeace@...il.com>
Subject: Re: [PATCH] mtd: nand: fix bug writing 1 byte less than page size

On Mon, 18 Jul 2016 10:39:18 +0200
Hector Palacios <hector.palacios@...i.com> wrote:

> nand_do_write_ops() determines if it is writing a partial page with the
> formula:
> 	part_pagewr = (column || writelen < (mtd->writesize - 1))
> 
> When 'writelen' is exactly 1 byte less than the NAND page size the formula
> equates to zero, so the code doesn't process it as a partial write,
> although it should.
> As a consequence the function remains in the while(1) loop with 'writelen'
> becoming 0xffffffff and iterating endlessly.
> 
> The bug may not be easy to reproduce in Linux since user space tools
> usually force the padding or round-up the write size to a page-size
> multiple.
> This was discovered in U-Boot where the issue can be reproduced by
> writing any size that is 1 byte less than a page-size multiple.
> For example, on a NAND with 2K page (0x800):
> 	=> nand erase.part <partition>
> 	=> nand write $loadaddr <partition> 7ff  
> 
> Signed-off-by: Hector Palacios <hector.palacios@...i.com>

Acked-by: Boris Brezillon <boris.brezillon@...e-electrons.com>

Brian, can you take this patch in your tree.

As usual, I'm unsure whether we should Cc stable or not, but we
should at least add

Fixes: 66507c7bc8895 ("mtd: nand: Add support to use nand_base poi databuf as bounce buffer")

> ---
>  drivers/mtd/nand/nand_base.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
> index 0b0dc29d2af7..77533f7f2429 100644
> --- a/drivers/mtd/nand/nand_base.c
> +++ b/drivers/mtd/nand/nand_base.c
> @@ -2610,7 +2610,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
>  		int cached = writelen > bytes && page != blockmask;
>  		uint8_t *wbuf = buf;
>  		int use_bufpoi;
> -		int part_pagewr = (column || writelen < (mtd->writesize - 1));
> +		int part_pagewr = (column || writelen < mtd->writesize);
>  
>  		if (part_pagewr)
>  			use_bufpoi = 1;