linux-kernel - Re: [PATCH 1/2] Fix FSL NAND driver to read all ONFI parameter pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180430120046.3c87db2a@bbrezillon>
Date:   Mon, 30 Apr 2018 12:00:46 +0200
From:   Boris Brezillon <boris.brezillon@...tlin.com>
To:     Jane Wan <Jane.Wan@...ia.com>
Cc:     dwmw2@...radead.org, computersforpeace@...il.com,
        ties.bos@...ia.com, linux-mtd@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] Fix FSL NAND driver to read all ONFI parameter
 pages

Hi Jane,

On Thu, 26 Apr 2018 17:19:55 -0700
Jane Wan <Jane.Wan@...ia.com> wrote:

> Signed-off-by: Jane Wan <Jane.Wan@...ia.com>
> ---
>  drivers/mtd/nand/fsl_ifc_nand.c |   10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
> index ca36b35..a3cf6ca 100644
> --- a/drivers/mtd/nand/fsl_ifc_nand.c
> +++ b/drivers/mtd/nand/fsl_ifc_nand.c
> @@ -413,6 +413,7 @@ static void fsl_ifc_cmdfunc(struct mtd_info *mtd, unsigned int command,
>  	struct fsl_ifc_mtd *priv = chip->priv;
>  	struct fsl_ifc_ctrl *ctrl = priv->ctrl;
>  	struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
> +	int len;
>  
>  	/* clear the read buffer */
>  	ifc_nand_ctrl->read_bytes = 0;
> @@ -462,11 +463,12 @@ static void fsl_ifc_cmdfunc(struct mtd_info *mtd, unsigned int command,
>  		ifc_out32(column, &ifc->ifc_nand.row3);
>  
>  		/*
> -		 * although currently it's 8 bytes for READID, we always read
> -		 * the maximum 256 bytes(for PARAM)
> +		 * For READID, read 8 bytes that are currently used.
> +		 * For PARAM, read all 3 copies of 256-bytes pages.
>  		 */
> -		ifc_out32(256, &ifc->ifc_nand.nand_fbcr);
> -		ifc_nand_ctrl->read_bytes = 256;
> +		len = (command == NAND_CMD_PARAM) ? (3 * 256) : 8;
> +		ifc_out32(len, &ifc->ifc_nand.nand_fbcr);
> +		ifc_nand_ctrl->read_bytes = len;

This driver really calls for a clean rework to transition to
->exec_op(). Guessing the amount of data to be read from ->cmdfunc() is
broken and your patch series just shows how broken this is. What next?
What if some NANDs have 4 or more copies of the param page?

I'm still undecided whether I want to apply this patch. I guess having
some guarantees that someone will actually work on implementing
->exec_op() in a near future would help me take this decision.

Regards,

Boris