linux-kernel - RE: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F88C5DDA1E80143B232E89585ACE27D0263D40B@DGGEMM528-MBX.china.huawei.com>
Date:   Fri, 22 Feb 2019 14:50:23 +0000
From:   "liujian (CE)" <liujian56@...wei.com>
To:     Vignesh R <vigneshr@...com>,
        "dwmw2@...radead.org" <dwmw2@...radead.org>,
        "computersforpeace@...il.com" <computersforpeace@...il.com>,
        "bbrezillon@...nel.org" <bbrezillon@...nel.org>,
        "marek.vasut@...il.com" <marek.vasut@...il.com>,
        "richard@....at" <richard@....at>,
        "joakim.tjernlund@...inera.com" <joakim.tjernlund@...inera.com>,
        "ikegami@...ied-telesis.co.jp" <ikegami@...ied-telesis.co.jp>,
        "keescook@...omium.org" <keescook@...omium.org>
CC:     "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c
 do_write_buffer


> -----Original Message-----
> From: Vignesh R [mailto:vigneshr@...com]
> Sent: Friday, February 22, 2019 1:59 PM
> To: liujian (CE) <liujian56@...wei.com>; dwmw2@...radead.org;
> computersforpeace@...il.com; bbrezillon@...nel.org;
> marek.vasut@...il.com; richard@....at; joakim.tjernlund@...inera.com;
> ikegami@...ied-telesis.co.jp; keescook@...omium.org
> Cc: linux-mtd@...ts.infradead.org; linux-kernel@...r.kernel.org
> Subject: Re: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
> 
> 
> 
> On 20/02/19 2:17 AM, Liu Jian wrote:
> > In function do_write_buffer(), in the for loop, there is a case
> > chip_ready() returns 1 while chip_good() returns 0, so it never break
> > the loop.
> > To fix this, chip_good() is enough and it should timeout if it stay
> > bad for a while.
> >
> > Fixes: dfeae1073583 ("mtd: cfi_cmdset_0002: Change write buffer to
> > check correct value")
> > Signed-off-by: Yi Huaijie <yihuaijie@...wei.com>
> > Signed-off-by: Liu Jian <liujian56@...wei.com>
> > Reviewed-by: Tokunori Ikegami <ikegami_to@...oo.co.jp>
> > ---
> > v1->v2:
> > change git log, put the Fixes tag on a single line
> >
> >  drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c
> > b/drivers/mtd/chips/cfi_cmdset_0002.c
> > index 72428b6..818e94b 100644
> > --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> > +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> > @@ -1876,14 +1876,14 @@ static int __xipram do_write_buffer(struct
> map_info *map, struct flchip *chip,
> >  			continue;
> >  		}
> >
> > -		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
> > -			break;
> > -
> >  		if (chip_good(map, adr, datum)) {
> >  			xip_enable(map, chip, adr);
> >  			goto op_done;
> >  		}
> >
> > +		if (time_after(jiffies, timeo))
> > +			break;
> > +
> 
> It is quite possible that this thread might be pre-empted just after
> chip_good() check but before before time_after(). If the thread, then resumes
> execution after timeo has elasped then, this code will wrongly indicate write
> failure.
> 
> To avoid this case, you should add one more check for check_good() even when
> time_after() returns true. Something like:
> 
> 	if (time_after(jiffies, timeo)) {
> 		if (chip_good(map, adr, datum)) {
> 			xip_enable(map, chip, adr);
> 			goto op_done;
> 		}
> 		break;
> 	}
> 
So,  the patch should like this ?

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 72428b6..3da2376 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1876,7 +1876,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                        continue;
                }

-               if (time_after(jiffies, timeo) && !chip_ready(map, adr))
+               if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
                        break;

                if (chip_good(map, adr, datum)) {



Any other opinions?
If there are no other comments, I will send a patch again

> 
> >  		/* Latency issues. Drop the lock, wait a while and retry */
> >  		UDELAY(map, chip, adr, 1);
> >  	}
> >
> 
> --
> Regards
> Vignesh