linux-kernel - Re: [PATCH next] mtd: maps: physmap: Fix infinite loop crash in ROM type probing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 7 Nov 2018 08:33:57 +0100
From:   Ricardo Ribalda Delgado <ricardo.ribalda@...il.com>
To:     Boris Brezillon <boris.brezillon@...tlin.com>
Cc:     Geert Uytterhoeven <geert@...ux-m68k.org>,
        David Woodhouse <dwmw2@...radead.org>,
        Brian Norris <computersforpeace@...il.com>,
        Marek Vasut <marek.vasut@...il.com>,
        Richard Weinberger <richard@....at>,
        Linus Walleij <linus.walleij@...aro.org>,
        linux-mtd@...ts.infradead.org, linux-mips@...ux-mips.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH next] mtd: maps: physmap: Fix infinite loop crash in ROM
 type probing

Hi Boris and Geert

On Tue, Nov 6, 2018 at 11:34 PM Boris Brezillon
<boris.brezillon@...tlin.com> wrote:
>
> On Tue, 6 Nov 2018 23:19:14 +0100
> Geert Uytterhoeven <geert@...ux-m68k.org> wrote:
>
> > Hi Boris,
> >
> > On Tue, Nov 6, 2018 at 10:58 PM Boris Brezillon
> > <boris.brezillon@...tlin.com> wrote:
> > > On Tue,  6 Nov 2018 22:44:16 +0100
> > > Geert Uytterhoeven <geert@...ux-m68k.org> wrote:
> > > > On Toshiba RBTX4927, where map_probe is supposed to fail:
> > > >
> > > >     Creating 2 MTD partitions on "physmap-flash.0":
> > > >     0x000000c00000-0x000001000000 : "boot"
> > > >     0x000000000000-0x000000c00000 : "user"
> > > >     physmap-flash physmap-flash.1: physmap platform flash device: [mem 0x1e000000-0x1effffff]
> > > >     CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 80320f40, ra == 80321004
> > > >     ...
> > > >     Call Trace:
> > > >     [<80320f40>] get_mtd_chip_driver+0x30/0x8c
> > > >     [<80321004>] do_map_probe+0x20/0x90
> > > >     [<80328448>] physmap_flash_probe+0x484/0x4ec
> > > >
> > > > The access to rom_probe_types[] was changed from a sentinel-based loop
> > > > to an infinite loop, causing a crash when reaching the sentinel.
> > >
> > > Oops. Do you mind if I fix that in-place (squash your changes in
> > > Ricardo's original commit)?
>
> Done.
>
> >
> > No problem. Thanks!
>

Thanks to both of you for fixing this .
> Thanks for reporting/fixing the bug.
>
> Boris
>


-- 
Ricardo Ribalda