linux-kernel - Re: [PATCH 3/7] mtd: spi-nor: add restriction for nmaps in smpt parser

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Nov 2018 13:58:45 +0000
From:   <Tudor.Ambarus@...rochip.com>
To:     <boris.brezillon@...tlin.com>
CC:     <marek.vasut@...il.com>, <dwmw2@...radead.org>,
        <computersforpeace@...il.com>, <richard@....at>,
        <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
        <yogeshnarayan.gaur@....com>, <cyrille.pitchen@...ev4u.fr>
Subject: Re: [PATCH 3/7] mtd: spi-nor: add restriction for nmaps in smpt
 parser



On 11/08/2018 02:54 PM, Boris Brezillon wrote:
> On Thu, 8 Nov 2018 11:07:11 +0000
> <Tudor.Ambarus@...rochip.com> wrote:
> 
>> The map selector is limited to a maximum of 8 bits, allowing
>> for a maximum of 256 possible map configurations. The total
>> number of map configurations should be addressable by the
>> total number of bits described by the detection commands.
>>
>> For example: if there are five to eight possible sector map
>> configurations, at least three configuration detection commands
>> will be needed to extract three bits of configuration selection
>> information from the device in order to identify which configuration
>> is currently in use.
>>
>> Suggested-by: Boris Brezillon <boris.brezillon@...tlin.com>
> 
> I don't remember suggesting this :-).

I see this when you discussed with Yogesh:

+       for (nmaps = 0; i< smpt_len; nmaps++) {
+               if(!(smpt[i] & SMPT_DESC_TYPE_MAP)) {
+                       i += 2;
+                       continue;
+               }
+
+               if(!map_id_is_valid) {
+                       if (nmaps) {
+                               ret = NULL;
+                               break;
+                       }

If I understand correctly, you meant that if there are no detection commands,
and more than a configuration map, then return an error.

This is correct in my opinion. What I did was to generalize this idea. If smtp
defines more maps than you can select using detection commands, return error.

+
+                       ret = smpt+i;
+               } else if (map_id == SMPT_MAP_ID(smpt[i])) {
+                       ret = smpt+i;
+                       break;
+               }
+
                /* increment the table index to the next map */
                i += SMPT_MAP_REGION_COUNT(smpt[i]) + 1;
        }

> 
>> Signed-off-by: Tudor Ambarus <tudor.ambarus@...rochip.com>
>> ---
>>  drivers/mtd/spi-nor/spi-nor.c | 15 +++++++++++++--
>>  1 file changed, 13 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
>> index 59dcedb08691..bd1866d714f2 100644
>> --- a/drivers/mtd/spi-nor/spi-nor.c
>> +++ b/drivers/mtd/spi-nor/spi-nor.c
>> @@ -2868,7 +2868,7 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
>>  	const u32 *ret = NULL;
>>  	u32 addr;
>>  	int err;
>> -	u8 i;
>> +	u8 i, ncmds, nmaps;
>>  	u8 addr_width, read_opcode, read_dummy;
>>  	u8 read_data_mask, data_byte, map_id;
>>  
>> @@ -2877,6 +2877,7 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
>>  	read_opcode = nor->read_opcode;
>>  
>>  	map_id = 0;
>> +	ncmds = 0;
>>  	/* Determine if there are any optional Detection Command Descriptors */
>>  	for (i = 0; i < smpt_len; i += 2) {
>>  		if (smpt[i] & SMPT_DESC_TYPE_MAP)
>> @@ -2896,6 +2897,7 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
>>  		 * Configuration that is currently in use.
>>  		 */
>>  		map_id = map_id << 1 | !!(data_byte & read_data_mask);
>> +		ncmds++;
>>  	}
>>  
>>  	/*
>> @@ -2905,7 +2907,16 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
>>  	 *
>>  	 * Find the matching configuration map.
>>  	 */
>> -	while (i < smpt_len) {
>> +	for (nmaps = 0; i < smpt_len; nmaps++) {
>> +		/*
>> +		 * The map selector is limited to a maximum of 8 bits, allowing
>> +		 * for a maximum of 256 possible map configurations. The total
>> +		 * number of map configurations should be addressable by the
>> +		 * total number of bits described by the detection commands.
>> +		 */
>> +		if (ncmds && nmaps >= (1 << (ncmds + 1)))
>> +			break;
>> +
> 
> Maybe I missed something but it sounds like this change is just
> optimizing the SPMT parsing a bit, and to be honest, I'm not sure this
> is really needed. Most of the time, smpt_len will be rather small, so
> trying to bail out earlier is not bringing much perf improvements.

It's rather a smtp validity check. I want to return an error if there are not
enough detection commands to identify the map id.

Cheers,
ta