Patch "mtd: cfi_cmdset_0001: Byte swap OTP info" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mtd: cfi_cmdset_0001: Byte swap OTP info

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mtd-cfi_cmdset_0001-byte-swap-otp-info.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 680fbd38de7d070e57067f270cf47f810334008e
Author: Linus Walleij <linus.walleij@xxxxxxxxxx>
Date:   Fri Oct 20 22:30:29 2023 +0200

    mtd: cfi_cmdset_0001: Byte swap OTP info
    
    [ Upstream commit 565fe150624ee77dc63a735cc1b3bff5101f38a3 ]
    
    Currently the offset into the device when looking for OTP
    bits can go outside of the address of the MTD NOR devices,
    and if that memory isn't readable, bad things happen
    on the IXP4xx (added prints that illustrate the problem before
    the crash):
    
    cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100
    ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78
    cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000
    ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78
    8<--- cut here ---
    Unable to handle kernel paging request at virtual address db000000
    [db000000] *pgd=00000000
    (...)
    
    This happens in this case because the IXP4xx is big endian and
    the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not
    properly byteswapped. Compare to how the code in read_pri_intelext()
    byteswaps the fields in struct cfi_pri_intelext.
    
    Adding a small byte swapping loop for the OTP in read_pri_intelext()
    and the crash goes away.
    
    The problem went unnoticed for many years until I enabled
    CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug.
    
    Cc: stable@xxxxxxxxxxxxxxx
    Reviewed-by: Nicolas Pitre <nico@xxxxxxxxxxx>
    Signed-off-by: Linus Walleij <linus.walleij@xxxxxxxxxx>
    Signed-off-by: Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
    Link: https://lore.kernel.org/linux-mtd/20231020-mtd-otp-byteswap-v4-1-0d132c06aa9d@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index e5cf4911a714a..3bd812435f1b9 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -420,9 +420,25 @@ read_pri_intelext(struct map_info *map, __u16 adr)
 		extra_size = 0;
 
 		/* Protection Register info */
-		if (extp->NumProtectionFields)
+		if (extp->NumProtectionFields) {
+			struct cfi_intelext_otpinfo *otp =
+				(struct cfi_intelext_otpinfo *)&extp->extra[0];
+
 			extra_size += (extp->NumProtectionFields - 1) *
-				      sizeof(struct cfi_intelext_otpinfo);
+				sizeof(struct cfi_intelext_otpinfo);
+
+			if (extp_size >= sizeof(*extp) + extra_size) {
+				int i;
+
+				/* Do some byteswapping if necessary */
+				for (i = 0; i < extp->NumProtectionFields - 1; i++) {
+					otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr);
+					otp->FactGroups = le16_to_cpu(otp->FactGroups);
+					otp->UserGroups = le16_to_cpu(otp->UserGroups);
+					otp++;
+				}
+			}
+		}
 	}
 
 	if (extp->MinorVersion >= '1') {



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux