linux-kernel - Re: [PATCH next] mtd: maps: physmap: Fix infinite loop crash in ROM type probing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181106233432.76df6bbf@bbrezillon>
Date:   Tue, 6 Nov 2018 23:34:32 +0100
From:   Boris Brezillon <boris.brezillon@...tlin.com>
To:     Geert Uytterhoeven <geert@...ux-m68k.org>
Cc:     Ricardo Ribalda Delgado <ricardo.ribalda@...il.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Brian Norris <computersforpeace@...il.com>,
        Marek Vasut <marek.vasut@...il.com>,
        Richard Weinberger <richard@....at>,
        Linus Walleij <linus.walleij@...aro.org>,
        MTD Maling List <linux-mtd@...ts.infradead.org>,
        Linux MIPS Mailing List <linux-mips@...ux-mips.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH next] mtd: maps: physmap: Fix infinite loop crash in ROM
 type probing

On Tue, 6 Nov 2018 23:19:14 +0100
Geert Uytterhoeven <geert@...ux-m68k.org> wrote:

> Hi Boris,
> 
> On Tue, Nov 6, 2018 at 10:58 PM Boris Brezillon
> <boris.brezillon@...tlin.com> wrote:
> > On Tue,  6 Nov 2018 22:44:16 +0100
> > Geert Uytterhoeven <geert@...ux-m68k.org> wrote:  
> > > On Toshiba RBTX4927, where map_probe is supposed to fail:
> > >
> > >     Creating 2 MTD partitions on "physmap-flash.0":
> > >     0x000000c00000-0x000001000000 : "boot"
> > >     0x000000000000-0x000000c00000 : "user"
> > >     physmap-flash physmap-flash.1: physmap platform flash device: [mem 0x1e000000-0x1effffff]
> > >     CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 80320f40, ra == 80321004
> > >     ...
> > >     Call Trace:
> > >     [<80320f40>] get_mtd_chip_driver+0x30/0x8c
> > >     [<80321004>] do_map_probe+0x20/0x90
> > >     [<80328448>] physmap_flash_probe+0x484/0x4ec
> > >
> > > The access to rom_probe_types[] was changed from a sentinel-based loop
> > > to an infinite loop, causing a crash when reaching the sentinel.  
> >
> > Oops. Do you mind if I fix that in-place (squash your changes in
> > Ricardo's original commit)?

Done.

> 
> No problem. Thanks!

Thanks for reporting/fixing the bug.

Boris