linux-kernel - Re: [PATCH v5 2/2] mtd: rawnand: meson: add support for Amlogic NAND flash controller

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 19 Oct 2018 17:01:51 +0800
From:   Liang Yang <liang.yang@...ogic.com>
To:     Boris Brezillon <boris.brezillon@...tlin.com>
CC:     Jianxin Pan <jianxin.pan@...ogic.com>,
        <linux-mtd@...ts.infradead.org>, Yixun Lan <yixun.lan@...ogic.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Brian Norris <computersforpeace@...il.com>,
        Marek Vasut <marek.vasut@...il.com>,
        Richard Weinberger <richard@....at>,
        Jerome Brunet <jbrunet@...libre.com>,
        Neil Armstrong <narmstrong@...libre.com>,
        Martin Blumenstingl <martin.blumenstingl@...glemail.com>,
        Carlo Caione <carlo@...one.org>,
        Kevin Hilman <khilman@...libre.com>,
        Rob Herring <robh@...nel.org>, Jian Hu <jian.hu@...ogic.com>,
        Hanjie Lin <hanjie.lin@...ogic.com>,
        Victor Wan <victor.wan@...ogic.com>,
        <linux-amlogic@...ts.infradead.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v5 2/2] mtd: rawnand: meson: add support for Amlogic NAND
 flash controller



On 2018/10/19 16:42, Boris Brezillon wrote:
> On Fri, 19 Oct 2018 16:29:40 +0800
> Liang Yang <liang.yang@...ogic.com> wrote:
> 
>> On 2018/10/19 4:50, Boris Brezillon wrote:
>>> On Thu, 18 Oct 2018 13:09:05 +0800
>>> Jianxin Pan <jianxin.pan@...ogic.com> wrote:
>>>    
>>>> +static int meson_nfc_buffer_init(struct mtd_info *mtd)
>>>> +{
>>>> +	struct nand_chip *nand = mtd_to_nand(mtd);
>>>> +	struct meson_nfc *nfc = nand_get_controller_data(nand);
>>>> +	static int max_page_bytes, max_info_bytes;
>>>> +	int page_bytes, info_bytes;
>>>> +	int nsectors;
>>>> +
>>>> +	nsectors = mtd->writesize / nand->ecc.size;
>>>> +	page_bytes =  mtd->writesize + mtd->oobsize;
>>>> +	info_bytes = nsectors * PER_INFO_BYTE;
>>>> +
>>>> +	if (nfc->data_buf && nfc->info_buf) {
>>>> +		if (max_page_bytes < page_bytes)
>>>> +			meson_nfc_free_buffer(nfc);
>>>> +		else
>>>> +			return 0;
>>>> +	}
>>>> +
>>>> +	max_page_bytes = max_t(int, max_page_bytes, page_bytes);
>>>> +	max_info_bytes = max_t(int, max_info_bytes, info_bytes);
>>>> +
>>>> +	nfc->data_buf = kmalloc(max_page_bytes, GFP_KERNEL);
>>>
>>> Is there a good reason for not using chip->data_buf and allocating a
>>> new buffer here?
>>>    
>> when calling read_oob or write_oob, i need a mid-buffer which is used in
>> meson_nfc_prase_data_oob(). i.e. after reading a page data into
>> nfc->data_buf, I will format it and transfer to chip->data_buf.
>>
>>
>>>> +	if (!nfc->data_buf)
>>>> +		return -ENOMEM;
>>>> +
>>>> +	nfc->info_buf = kmalloc(max_info_bytes, GFP_KERNEL);
>>>> +	if (!nfc->info_buf) {
>>>> +		kfree(nfc->data_buf);
>>>> +		return -ENOMEM;
>>>> +	}
>>>
>>> I'd recommend moving this info_buf in the priv chip struct, otherwise
>>> you'll have to protect nfc->info_buf with a lock to prevent an already
>>> register chip from using this pointer while you're reallocating the
>>> buffer. Also, I think you have a memleak here.
>>>    
>> ok, i will move it in the chip struct .
>>
>> but how memleak happens even i have called meson_nfc_free_buffer before
>> and free data_buf if info_buf alloc faied.
> 
> You're right, I missed the call to meson_nfc_free_buffer() when
> max_page_bytes < page_bytes. Still, this part is racy, just like the
> nfc->data_buf replacement is if you have several NAND chips. I'd
> recommend moving those bufs to the priv chip struct.
> 

ok. i will move data_duf and info_buf to priv chip struct.

>>
>>>> +
>>>> +	return 0;
>>>> +}
>>>
>>> .
>>>    
> 
> .
>