linux-kernel - Re: [bug] spi-nor not unlocking on Ubiquiti XW and WA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <DM6PR06MB5611F88B8684C981CB986867C546A@DM6PR06MB5611.namprd06.prod.outlook.com>
Date: Mon, 30 Jun 2025 13:50:02 -0400
From: Jean-Marc Ranger <jmranger@...mail.com>
To: Michael Walle <mwalle@...nel.org>, tudor.ambarus@...aro.org,
 pratyush@...nel.org, miquel.raynal@...tlin.com, richard@....at,
 vigneshr@...com, linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org
Cc: tim.j.wilkinson@...il.com
Subject: Re: [bug] spi-nor not unlocking on Ubiquiti XW and WA

On 2025-06-30 05:25, Michael Walle wrote:
> This seems to be due to the use of the uninitalized "mtd->size".
> Could you try the following patch which is based on the latest
> next kernel. It replaces mtd->size with nor->params->size, so you
> could backport it to 6.6, but maybe it will apply anyway.

Thank you so much for taking the time!

Your patch applies automatically on 6.6.93, with minimal fuzzing and 
offset changes. And it fixes the issue! Formally:
Tested-by: Jean-Marc Ranger <jmranger@...mail.com>

Thanks again,

Jean-Marc

> ---snip---
> diff --git a/drivers/mtd/spi-nor/swp.c b/drivers/mtd/spi-nor/swp.c
> index 9c9328478d8a..9b07f83aeac7 100644
> --- a/drivers/mtd/spi-nor/swp.c
> +++ b/drivers/mtd/spi-nor/swp.c
> @@ -56,7 +56,6 @@ static u64 spi_nor_get_min_prot_length_sr(struct spi_nor *nor)
>   static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs,
>   					u64 *len)
>   {
> -	struct mtd_info *mtd = &nor->mtd;
>   	u64 min_prot_len;
>   	u8 mask = spi_nor_get_sr_bp_mask(nor);
>   	u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
> @@ -77,13 +76,13 @@ static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs,
>   	min_prot_len = spi_nor_get_min_prot_length_sr(nor);
>   	*len = min_prot_len << (bp - 1);
>   
> -	if (*len > mtd->size)
> -		*len = mtd->size;
> +	if (*len > nor->params->size)
> +		*len = nor->params->size;
>   
>   	if (nor->flags & SNOR_F_HAS_SR_TB && sr & tb_mask)
>   		*ofs = 0;
>   	else
> -		*ofs = mtd->size - *len;
> +		*ofs = nor->params->size - *len;
>   }
>   
>   /*
> @@ -158,7 +157,6 @@ static bool spi_nor_is_unlocked_sr(struct spi_nor *nor, loff_t ofs, u64 len,
>    */
>   static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
>   {
> -	struct mtd_info *mtd = &nor->mtd;
>   	u64 min_prot_len;
>   	int ret, status_old, status_new;
>   	u8 mask = spi_nor_get_sr_bp_mask(nor);
> @@ -183,7 +181,7 @@ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
>   		can_be_bottom = false;
>   
>   	/* If anything above us is unlocked, we can't use 'top' protection */
> -	if (!spi_nor_is_locked_sr(nor, ofs + len, mtd->size - (ofs + len),
> +	if (!spi_nor_is_locked_sr(nor, ofs + len, nor->params->size - (ofs + len),
>   				  status_old))
>   		can_be_top = false;
>   
> @@ -195,11 +193,11 @@ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
>   
>   	/* lock_len: length of region that should end up locked */
>   	if (use_top)
> -		lock_len = mtd->size - ofs;
> +		lock_len = nor->params->size - ofs;
>   	else
>   		lock_len = ofs + len;
>   
> -	if (lock_len == mtd->size) {
> +	if (lock_len == nor->params->size) {
>   		val = mask;
>   	} else {
>   		min_prot_len = spi_nor_get_min_prot_length_sr(nor);
> @@ -248,7 +246,6 @@ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
>    */
>   static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
>   {
> -	struct mtd_info *mtd = &nor->mtd;
>   	u64 min_prot_len;
>   	int ret, status_old, status_new;
>   	u8 mask = spi_nor_get_sr_bp_mask(nor);
> @@ -273,7 +270,7 @@ static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
>   		can_be_top = false;
>   
>   	/* If anything above us is locked, we can't use 'bottom' protection */
> -	if (!spi_nor_is_unlocked_sr(nor, ofs + len, mtd->size - (ofs + len),
> +	if (!spi_nor_is_unlocked_sr(nor, ofs + len, nor->params->size - (ofs + len),
>   				    status_old))
>   		can_be_bottom = false;
>   
> @@ -285,7 +282,7 @@ static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
>   
>   	/* lock_len: length of region that should remain locked */
>   	if (use_top)
> -		lock_len = mtd->size - (ofs + len);
> +		lock_len = nor->params->size - (ofs + len);
>   	else
>   		lock_len = ofs;
>   
> ---snip---
> 
> -michael