Patchwork Oops with mtd_dataflash driver in 3.3

login
register
mail settings
Submitter Will Newton
Date March 30, 2012, 10:51 a.m.
Message ID <CAFbHwiTfaXOFX-WYWeyisK4WCiXBRv_LpEcoR=v8qvsLAO7FJQ@mail.gmail.com>
Download mbox | patch
Permalink /patch/149612/
State New
Headers show

Comments

Will Newton - March 30, 2012, 10:51 a.m.
Hi all,

I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
with -1 for offset and length and a NULL buffer to test if OTP
operations are supported. This finds its way down to otp_read in
mtd_dataflash.c and causes an oops when memcpying the returned data
into the NULL buf.

None of the checks in otp_read catches the negative length and offset.
Changing the length of the dummy read to 0 prevents the oops, but I'm
not sure if it is the preferred solution. Would this change be
acceptable?

        switch (mode) {

Thanks,
Artem Bityutskiy - April 13, 2012, 3:58 p.m.
On Fri, 2012-03-30 at 11:51 +0100, Will Newton wrote:
> Hi all,
> 
> I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
> be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
> with -1 for offset and length and a NULL buffer to test if OTP
> operations are supported. This finds its way down to otp_read in
> mtd_dataflash.c and causes an oops when memcpying the returned data
> into the NULL buf.

Hi, good catch, thanks!

I've added "Cc: stable@krnel.org [3.3+]" and pushed to l2-mtd.git,
thanks you.

But note, you should add your Signed-off-by when sending patches.
Also this patch is line-wrapped so I had to do a small surgery to apply
it. Try to save it from your mailbox and apply with 'git am'.

Anyway, thanks for the catch.

Patch

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 50c6a1e..853744d 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -369,7 +369,7 @@  static int otp_select_filemode(struct
mtd_file_info *mfi, int mode)
         * Make a fake call to mtd_read_fact_prot_reg() to check if OTP
         * operations are supported.
         */
-       if (mtd_read_fact_prot_reg(mtd, -1, -1, &retlen, NULL) == -EOPNOTSUPP)
+       if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == -EOPNOTSUPP)
                return -EOPNOTSUPP;