linux-kernel - Re: mtd: nand: raw: Possible bug in nand_onfi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 25 Mar 2024 10:59:09 +0100
From: Alexander Dahl <ada@...rsis.com>
To: Miquel Raynal <miquel.raynal@...tlin.com>
Cc: Alexander Dahl <ada@...rsis.com>, linux-mtd@...ts.infradead.org,
	Richard Weinberger <richard@....at>,
	Vignesh Raghavendra <vigneshr@...com>, linux-kernel@...r.kernel.org
Subject: Re: mtd: nand: raw: Possible bug in nand_onfi_detect()?

Hello Miquèl,

Am Mon, Mar 25, 2024 at 10:09:16AM +0100 schrieb Miquel Raynal:
> Hello Alexander,
> 
> > > > > The condition is true and nand_change_read_column_op() returns with
> > > > > -EINVAL, because mtd->writesize and mtd->oobsize are not set yet in
> > > > > that code path.  Those are probably initialized later, maybe with
> > > > > parameters read from that ONFI param page?
> > > > > 
> > > > > Returning with error from nand_change_read_column_op() leads to
> > > > > jumping out of nand_onfi_detect() early, and no ONFI param page is
> > > > > evaluated at all, although the second or third page could be intact.
> > > > > 
> > > > > I guess this would also fail with any other reason for not matching
> > > > > CRCs in the first page, but I have not faulty NAND flash chip to
> > > > > confirm that.    
> > > > 
> > > > Thanks for the whole report, it is interesting and should lead to fixes:
> > > > - why does the controller refuses the datain op?    
> > > 
> > > See above.
> > >   
> > > > - why nand_soft_waitrdy is not enough?    
> > > 
> > > I don't know.  That's one reason I asked here.
> > >   
> > > > - changing the condition in nand_change_read_column_op()
> > > > 
> > > > Can you take care of these?    
> 
> Now would be a perfect time to send these fixes. Could you work on them?

I'm sorry, no not yet.  Have some more important work to do, which
will take another one or two weeks before I can return to this
problem.  Will have to wait, at least from my side.

Greets
Alex

> 
> Thanks!
> Miquèl