linux-kernel - [PATCH] staging:mt29f_spinand: MT29F2G failing as only 16-bit arguments and variables used for addressing.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  1 Aug 2018 11:24:19 +0800
From:   Jheng-Jhong Wu <goodwater.wu@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     goodwater.wu@...il.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Boris Brezillon <boris.brezillon@...tlin.com>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Arun Nagendran <arunrasppi@...il.com>,
        Miquel Raynal <miquel.raynal@...tlin.com>,
        Palle Christensen <palle.christensen@...rosemi.com>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: [PATCH] staging:mt29f_spinand: MT29F2G failing as only 16-bit arguments and variables used for addressing.

For NAND flash chips with more than 1Gbit (e.g. MT29F2G) more than 16 bits
are necessary to address the correct page. The driver sets the address for
more than 16 bits, but it uses 16-bit arguments and variables (these are
page_id, block_id, row) to do address operations. Obviously, these
arguments and variables cannot deal with more than 16-bit address.

Signed-off-by: Jheng-Jhong Wu <goodwater.wu@...il.com>
---
 drivers/staging/mt29f_spinand/mt29f_spinand.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
index 4484784..a0f4cbcb 100644
--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
+++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
@@ -308,10 +308,10 @@ static int spinand_write_enable(struct spi_device *spi_nand)
 	return spinand_cmd(spi_nand, &cmd);
 }
 
-static int spinand_read_page_to_cache(struct spi_device *spi_nand, u16 page_id)
+static int spinand_read_page_to_cache(struct spi_device *spi_nand, u32 page_id)
 {
 	struct spinand_cmd cmd = {0};
-	u16 row;
+	u32 row;
 
 	row = page_id;
 	cmd.cmd = CMD_READ;
@@ -331,7 +331,7 @@ static int spinand_read_page_to_cache(struct spi_device *spi_nand, u16 page_id)
  *   locations.
  *   No tRd delay.
  */
-static int spinand_read_from_cache(struct spi_device *spi_nand, u16 page_id,
+static int spinand_read_from_cache(struct spi_device *spi_nand, u32 page_id,
 				   u16 byte_id, u16 len, u8 *rbuf)
 {
 	struct spinand_cmd cmd = {0};
@@ -362,7 +362,7 @@ static int spinand_read_from_cache(struct spi_device *spi_nand, u16 page_id,
  *   The read includes two commands to the Nand - 0x13 and 0x03 commands
  *   Poll to read status to wait for tRD time.
  */
-static int spinand_read_page(struct spi_device *spi_nand, u16 page_id,
+static int spinand_read_page(struct spi_device *spi_nand, u32 page_id,
 			     u16 offset, u16 len, u8 *rbuf)
 {
 	int ret;
@@ -430,7 +430,7 @@ static int spinand_read_page(struct spi_device *spi_nand, u16 page_id,
  *   Since it is writing the data to cache, there is no tPROG time.
  */
 static int spinand_program_data_to_cache(struct spi_device *spi_nand,
-					 u16 page_id, u16 byte_id,
+					 u32 page_id, u16 byte_id,
 					 u16 len, u8 *wbuf)
 {
 	struct spinand_cmd cmd = {0};
@@ -457,10 +457,10 @@ static int spinand_program_data_to_cache(struct spi_device *spi_nand,
  *   the Nand array.
  *   Need to wait for tPROG time to finish the transaction.
  */
-static int spinand_program_execute(struct spi_device *spi_nand, u16 page_id)
+static int spinand_program_execute(struct spi_device *spi_nand, u32 page_id)
 {
 	struct spinand_cmd cmd = {0};
-	u16 row;
+	u32 row;
 
 	row = page_id;
 	cmd.cmd = CMD_PROG_PAGE_EXC;
@@ -486,7 +486,7 @@ static int spinand_program_execute(struct spi_device *spi_nand, u16 page_id)
  *   Poll to wait for the tPROG time to finish the transaction.
  */
 static int spinand_program_page(struct spi_device *spi_nand,
-				u16 page_id, u16 offset, u16 len, u8 *buf)
+				u32 page_id, u16 offset, u16 len, u8 *buf)
 {
 	int retval;
 	u8 status = 0;
@@ -573,10 +573,10 @@ static int spinand_program_page(struct spi_device *spi_nand,
  *   one block--64 pages
  *   Need to wait for tERS.
  */
-static int spinand_erase_block_erase(struct spi_device *spi_nand, u16 block_id)
+static int spinand_erase_block_erase(struct spi_device *spi_nand, u32 block_id)
 {
 	struct spinand_cmd cmd = {0};
-	u16 row;
+	u32 row;
 
 	row = block_id;
 	cmd.cmd = CMD_ERASE_BLK;
@@ -599,7 +599,7 @@ static int spinand_erase_block_erase(struct spi_device *spi_nand, u16 block_id)
  *   and then send the 0xd8 erase command
  *   Poll to wait for the tERS time to complete the tranaction.
  */
-static int spinand_erase_block(struct spi_device *spi_nand, u16 block_id)
+static int spinand_erase_block(struct spi_device *spi_nand, u32 block_id)
 {
 	int retval;
 	u8 status = 0;
-- 
2.7.4