linux-kernel - Re: [PATCH next] mtd: maps: physmap: Fix infinite loop crash in ROM type probing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Nov 2018 23:19:14 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     Boris Brezillon <boris.brezillon@...tlin.com>
Cc:     Ricardo Ribalda Delgado <ricardo.ribalda@...il.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Brian Norris <computersforpeace@...il.com>,
        Marek Vasut <marek.vasut@...il.com>,
        Richard Weinberger <richard@....at>,
        Linus Walleij <linus.walleij@...aro.org>,
        MTD Maling List <linux-mtd@...ts.infradead.org>,
        Linux MIPS Mailing List <linux-mips@...ux-mips.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH next] mtd: maps: physmap: Fix infinite loop crash in ROM
 type probing

Hi Boris,

On Tue, Nov 6, 2018 at 10:58 PM Boris Brezillon
<boris.brezillon@...tlin.com> wrote:
> On Tue,  6 Nov 2018 22:44:16 +0100
> Geert Uytterhoeven <geert@...ux-m68k.org> wrote:
> > On Toshiba RBTX4927, where map_probe is supposed to fail:
> >
> >     Creating 2 MTD partitions on "physmap-flash.0":
> >     0x000000c00000-0x000001000000 : "boot"
> >     0x000000000000-0x000000c00000 : "user"
> >     physmap-flash physmap-flash.1: physmap platform flash device: [mem 0x1e000000-0x1effffff]
> >     CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 80320f40, ra == 80321004
> >     ...
> >     Call Trace:
> >     [<80320f40>] get_mtd_chip_driver+0x30/0x8c
> >     [<80321004>] do_map_probe+0x20/0x90
> >     [<80328448>] physmap_flash_probe+0x484/0x4ec
> >
> > The access to rom_probe_types[] was changed from a sentinel-based loop
> > to an infinite loop, causing a crash when reaching the sentinel.
>
> Oops. Do you mind if I fix that in-place (squash your changes in
> Ricardo's original commit)?

No problem. Thanks!

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds