target/linux/generic/hack-4.19/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch

   1 From c942c462411e4757aafba73bf13b5e5c7a4b62ca Mon Sep 17 00:00:00 2001
   2 From: Christian Lamparter <chunkeey@gmail.com>
   3 Date: Sun, 23 Dec 2018 00:38:55 +0100
   4 Subject: [PATCH] mtd: rawnand: qcom: fix memory corruption that causes panic
   5
   6 This patch fixes a memory corruption that occured in the
   7 qcom-nandc driver since it was converted to nand_scan().
   8
   9 On boot, an affected device will panic from a NPE at a weird place:
  10 | Unable to handle kernel NULL pointer dereference at virtual address 00000000
  11 | pgd = (ptrval)
  12 | [00000000] *pgd=00000000
  13 | Internal error: Oops: 80000005 [#1] SMP ARM
  14 | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
  15 | Hardware name: Generic DT based system
  16 | PC is at   (null)
  17 | LR is at nand_block_isbad+0x90/0xa4
  18 | pc : [<00000000>]    lr : [<c0592240>]    psr: 80000013
  19 | sp : cf839d40  ip : 00000000  fp : cfae9e20
  20 | r10: cf815810  r9 : 00000000  r8 : 00000000
  21 | r7 : 00000000  r6 : 00000000  r5 : 00000001  r4 : cf815810
  22 | r3 : 00000000  r2 : cfae9810  r1 : ffffffff  r0 : cf815810
  23 | Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
  24 | Control: 10c5387d  Table: 8020406a  DAC: 00000051
  25 | Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
  26 | [<c0592240>] (nand_block_isbad) from [<c0580a94>] (allocate_partition+0x7a0/0x7dc)
  27 | [<c0580a94>] (allocate_partition) from [<c05811e4>] (add_mtd_partitions+0x58/0x10c)
  28 | [<c05811e4>] (add_mtd_partitions) from [<c0581164>] (parse_mtd_partitions+0x310/0x338)
  29 | [<c0581164>] (parse_mtd_partitions) from [<c057def4>] (mtd_device_parse_register+0x60/0x15c)
  30 | [<c057def4>] (mtd_device_parse_register) from [<c059d274>] (qcom_nandc_probe+0x770/0x8f4)
  31 | [<c059d274>] (qcom_nandc_probe) from [<c0567f00>] (platform_drv_probe+0x34/0x70)
  32
  33 The problem is that the nand_scan()'s qcom_nand_attach_chip callback
  34 is updating the nandc->max_cwperpage from 1 to 4. This causes the
  35 sg_init_table of clear_bam_transaction() in the driver's
  36 qcom_nandc_block_bad() to memset much more than what was initially
  37 allocated by alloc_bam_transaction().
  38
  39 Hence, this patch restores the old behavior by performing the
  40 alloc_bam_transaction() after the chip was identified.
  41
  42 Fixes: 6a3cec64f18c ("mtd: rawnand: qcom: convert driver to nand_scan()")
  43 Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
  44 ---
  45  drivers/mtd/nand/raw/qcom_nandc.c | 20 ++++++++++----------
  46  1 file changed, 10 insertions(+), 10 deletions(-)
  47
  48 --- a/drivers/mtd/nand/raw/qcom_nandc.c
  49 +++ b/drivers/mtd/nand/raw/qcom_nandc.c
  50 @@ -2839,6 +2839,16 @@ static int qcom_nand_host_init_and_regis
  51         if (ret)
  52                 return ret;
  53
  54 +       if (nandc->props->is_bam) {
  55 +               free_bam_transaction(nandc);
  56 +               nandc->bam_txn = alloc_bam_transaction(nandc);
  57 +               if (!nandc->bam_txn) {
  58 +                       dev_err(nandc->dev,
  59 +                               "failed to allocate bam transaction\n");
  60 +                       return -ENOMEM;
  61 +               }
  62 +       }
  63 +
  64         ret = mtd_device_register(mtd, NULL, 0);
  65         if (ret)
  66                 nand_cleanup(chip);
  67 @@ -2853,16 +2863,6 @@ static int qcom_probe_nand_devices(struc
  68         struct qcom_nand_host *host;
  69         int ret;
  70
  71 -       if (nandc->props->is_bam) {
  72 -               free_bam_transaction(nandc);
  73 -               nandc->bam_txn = alloc_bam_transaction(nandc);
  74 -               if (!nandc->bam_txn) {
  75 -                       dev_err(nandc->dev,
  76 -                               "failed to allocate bam transaction\n");
  77 -                       return -ENOMEM;
  78 -               }
  79 -       }
  80 -
  81         for_each_available_child_of_node(dn, child) {
  82                 host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
  83                 if (!host) {