linux-kernel - Re: [PATCH v5 0/3] mtd: spinand: fix continuous reading mode support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7a8ef758-3117-4b1c-8362-39e2efffd5ef@iopsys.eu>
Date: Fri, 29 Aug 2025 10:15:35 +0300
From: Mikhail Kshevetskiy <mikhail.kshevetskiy@...sys.eu>
To: Miquel Raynal <miquel.raynal@...tlin.com>,
 Richard Weinberger <richard@....at>, Vignesh Raghavendra <vigneshr@...com>,
 Tudor Ambarus <tudor.ambarus@...aro.org>,
 Martin Kurbanov <mmkurbanov@...utedevices.com>,
 Takahiro Kuwano <Takahiro.Kuwano@...ineon.com>,
 Cheng Ming Lin <chengminglin@...c.com.tw>, linux-mtd@...ts.infradead.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5 0/3] mtd: spinand: fix continuous reading mode support

Miquel,
is there any comments?

Best regards,

Mikhail Kshevetskiy

On 24.08.2025 21:18, Mikhail Kshevetskiy wrote:
> Continuous reading mode is broken for some spi controllers. There are two
> possible bug scenarios:
>
> 1) "continuous mode" flash and spi controller without dirmap support,
>    but with restriction on transfer length in adjust_op_size()
>
> 2) "continuous mode" flash and spi controller with dirmap support for a
>    single flash page
>
> In the first case, any read that exceeds the limit specified in adjust_op_size()
> will result in an EIO error. The limit may even be less than a size of a single
> flash page. In this case, any read will result in an error.
>
> In the second case, any read larger than flash page size will result in an EIO
> error or spinand driver spoofing (because the spi controller driver returns
> more bytes than were actually read).
>
> This patch series tries to fix continuous reading (spinand driver side).
> Unfortunately these fixes can't resolve "spinand driver spoofing" case.
> Spi controller drivers might need fixes as well.
>
> Changes v2:
>  * added helper to create reading dirmap descriptor
>  * fix spelling
>  * error code is not used for regular reading fallback anymore
>  * it's possible (but very unlucky) that someone will do raw reading
>    of the flash in continuous mode (i.e. without OOB), so fix dirmap
>    creation for that case as well.
>
> Changes v3:
>  * improve description
>  * move airoha spi controller driver fix to a separate airoha spi fix series
>
> Changes v4:
>  * the period '.' at the end of the commit title was removed
>
> Changes v5:
>  * rename spinand_create_rdesc_helper() to spinand_create_rdesc()
>  * get rid of controller_is_buggy boolean
>
> Mikhail Kshevetskiy (3):
>   mtd: spinand: fix direct mapping creation sizes
>   mtd: spinand: try a regular dirmap if creating a dirmap for continuous
>     reading fails
>   mtd: spinand: repeat reading in regular mode if continuous reading
>     fails
>
>  drivers/mtd/nand/spi/core.c | 74 +++++++++++++++++++++++++++++--------
>  1 file changed, 59 insertions(+), 15 deletions(-)
>