linux-kernel - [PATCH v2] mtd: nand: realtek-ecc: relax OOB size check to minimum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <aYbjk7vRA/gMZPSx@DESKTOP-TIT0J8O.localdomain>
Date: Sat, 7 Feb 2026 11:02:43 +0400
From: Ahmed Naseef <naseefkm@...il.com>
To: Miquel@...ktop-tit0j8o.localdomain, Raynal@...ktop-tit0j8o.localdomain,
	miquel.raynal@...tlin.com, Richard@...ktop-tit0j8o.localdomain,
	Weinberger@...ktop-tit0j8o.localdomain, richard@....at,
	Vignesh@...ktop-tit0j8o.localdomain,
	Raghavendra@...ktop-tit0j8o.localdomain, vigneshr@...com,
	linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org,
	Markus Stockhausen <markus.stockhausen@....de>, naseefkm@...il.com
Subject: [PATCH v2] mtd: nand: realtek-ecc: relax OOB size check to minimum

The ECC engine strictly validates that flash OOB size equals exactly
64 bytes. However, some NAND chips have a larger physical OOB while
vendor firmware only uses the first 64 bytes for the ECC layout. For
example the Macronix MX35LF1G24AD found in the Netlink HG323DAC has
128 byte physical OOB but vendor firmware only uses the first 64
bytes (24 bytes free + 40 bytes BCH6 parity), leaving bytes 64-127
unused.

Since the engine only operates on the first 64 bytes of OOB
regardless of the physical size, change the check from exact match
to minimum size. Flash with OOB >= 64 bytes works correctly with
the engine's 64-byte layout.

Suggested-by: Markus Stockhausen <markus.stockhausen@....de>
Signed-off-by: Ahmed Naseef <naseefkm@...il.com>
---
On the Netlink HG323DAC with the Macronix MX35LF1G24AD (ID: 0xc2,
0x14), the Realtek ECC engine probe fails with:

  spi-nand spi0.0: Macronix SPI NAND was found.
  spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
  rtl-nand-ecc-engine 1801a600.ecc: only flash geometry data=2048, oob=64 supported
  nand: No suitable ECC configuration
  spi-nand spi0.0: probe with driver spi-nand failed with error -22

The chip has 128 bytes of physical OOB but the OEM firmware only uses
64 bytes (24 free + 40 BCH6 parity). The OEM bootlog confirms:

  nand: device found, Manufacturer ID: 0xc2, Chip ID: 0x14
  nand: Macronix
  nand: 128MiB, SLC, page size: 2048, OOB size: 64

The rtl9607c GPL sources have no specific entry for chip ID 0x14 in
the Macronix SPI NAND table and fall back to the default 64-byte
spare configuration with BCH6 ECC.

I verified this by booting an OpenWrt initramfs with the ECC engine
disabled and inspecting raw OOB via nanddump --noecc --oob. Both
the env and kernel partitions confirm the OEM layout uses only the
first 64 bytes:

  - OOB[0:23]:   24 bytes free  (4 steps x 6 bytes)
  - OOB[24:63]:  40 bytes BCH6 parity (4 steps x 10 bytes)
  - OOB[64:127]: unused (all 0xFF)

This matches the engine's expected format exactly. Since the engine
only operates on the first 64 bytes, the relaxation from exact match
to minimum size is safe for any flash with OOB >= 64.

Changes in v2:
  - Reorder Suggested-by before Signed-off-by
  - Update driver comment per Markus's review

 drivers/mtd/nand/ecc-realtek.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/mtd/nand/ecc-realtek.c b/drivers/mtd/nand/ecc-realtek.c
index 0046da37e..7d003fd72 100644
--- a/drivers/mtd/nand/ecc-realtek.c
+++ b/drivers/mtd/nand/ecc-realtek.c
@@ -17,10 +17,12 @@
  * - BCH12 : Generate 20 ECC bytes from 512 data bytes plus 6 free bytes
  *
  * It can run for arbitrary NAND flash chips with different block and OOB sizes. Currently there
- * are only two known devices in the wild that have NAND flash and make use of this ECC engine
- * (Linksys LGS328C & LGS352C). To keep compatibility with vendor firmware, new modes can only
- * be added when new data layouts have been analyzed. For now allow BCH6 on flash with 2048 byte
- * blocks and 64 bytes oob.
+ * are a few known devices in the wild that make use of this ECC engine
+ * (Linksys LGS328C, LGS352C & Netlink HG323DAC). To keep compatibility with vendor firmware,
+ * new modes can only be added when new data layouts have been analyzed. For now allow BCH6 on
+ * flash with 2048 byte blocks and at least 64 bytes oob. Some vendors make use of
+ * 128 bytes OOB NAND chips (e.g. Macronix MX35LF1G24AD) but only use BCH6 and thus the first
+ * 64 bytes of the OOB area. In this case the engine leaves any extra bytes unused.
  *
  * This driver aligns with kernel ECC naming conventions. Neverthless a short notice on the
  * Realtek naming conventions for the different structures in the OOB area.
@@ -39,7 +41,7 @@
  */
 
 #define RTL_ECC_ALLOWED_PAGE_SIZE 	2048
-#define RTL_ECC_ALLOWED_OOB_SIZE	64
+#define RTL_ECC_ALLOWED_MIN_OOB_SIZE	64
 #define RTL_ECC_ALLOWED_STRENGTH	6
 
 #define RTL_ECC_BLOCK_SIZE 		512
@@ -310,10 +312,10 @@ static int rtl_ecc_check_support(struct nand_device *nand)
 	struct mtd_info *mtd = nanddev_to_mtd(nand);
 	struct device *dev = nand->ecc.engine->dev;
 
-	if (mtd->oobsize != RTL_ECC_ALLOWED_OOB_SIZE ||
+	if (mtd->oobsize < RTL_ECC_ALLOWED_MIN_OOB_SIZE ||
 	    mtd->writesize != RTL_ECC_ALLOWED_PAGE_SIZE) {
-		dev_err(dev, "only flash geometry data=%d, oob=%d supported\n",
-			RTL_ECC_ALLOWED_PAGE_SIZE, RTL_ECC_ALLOWED_OOB_SIZE);
+		dev_err(dev, "only flash geometry data=%d, oob>=%d supported\n",
+			RTL_ECC_ALLOWED_PAGE_SIZE, RTL_ECC_ALLOWED_MIN_OOB_SIZE);
 		return -EINVAL;
 	}
 
-- 
2.34.1