linux-kernel - Re: [PATCH] mtd: nand: fix bug writing 1 byte less than page size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160719195610.GL76613@google.com>
Date:	Tue, 19 Jul 2016 12:56:10 -0700
From:	Brian Norris <computersforpeace@...il.com>
To:	Scott Wood <oss@...error.net>
Cc:	Boris Brezillon <boris.brezillon@...e-electrons.com>,
	Hector Palacios <hector.palacios@...i.com>,
	linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org,
	richard@....at, stable@...r.kernel.org
Subject: Re: [PATCH] mtd: nand: fix bug writing 1 byte less than page size

On Mon, Jul 18, 2016 at 05:37:22PM -0500, Scott Wood wrote:
> On Mon, 2016-07-18 at 11:04 +0200, Boris Brezillon wrote:
> > On Mon, 18 Jul 2016 10:39:18 +0200
> > Hector Palacios <hector.palacios@...i.com> wrote:
> > 
> > > 
> > > nand_do_write_ops() determines if it is writing a partial page with the
> > > formula:
> > > 	part_pagewr = (column || writelen < (mtd->writesize - 1))
> > > 
> > > When 'writelen' is exactly 1 byte less than the NAND page size the formula
> > > equates to zero, so the code doesn't process it as a partial write,
> > > although it should.
> > > As a consequence the function remains in the while(1) loop with 'writelen'
> > > becoming 0xffffffff and iterating endlessly.
> > > 
> > > The bug may not be easy to reproduce in Linux since user space tools
> > > usually force the padding or round-up the write size to a page-size
> > > multiple.
> > > This was discovered in U-Boot where the issue can be reproduced by
> > > writing any size that is 1 byte less than a page-size multiple.
> > > For example, on a NAND with 2K page (0x800):
> > > 	=> nand erase.part <partition>
> > > 	=> nand write $loadaddr <partition> 7ff  
> > > 
> > > Signed-off-by: Hector Palacios <hector.palacios@...i.com>
> > Acked-by: Boris Brezillon <boris.brezillon@...e-electrons.com>
> > 
> > Brian, can you take this patch in your tree.
> > 
> > As usual, I'm unsure whether we should Cc stable or not, but we
> > should at least add
> > 
> > Fixes: 66507c7bc8895 ("mtd: nand: Add support to use nand_base poi databuf
> > as bounce buffer")
> 
> That commit just moved the bad test; it was introduced in 29072b96078ffde3
> ("[MTD] NAND: add subpage write support").

Indeed. I've update the Fixes tag and added an additional comment in the
commit message.

Thanks,
Brian