| Message ID | 1265267917-2487-2-git-send-email-stanley.miao@windriver.com |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, 2010-02-04 at 15:18 +0800, Stanley.Miao wrote: > nand_write_oob will invoke nand_do_write_oob or nand_do_write_ops depending > on if ops->datbuf is NULL. nand_do_write_oob checked the validity of oob > but nand_do_write_ops didn't. Now move the check into nand_write_oob to > ensure the validity of oobbuf. > > Signed-off-by: Stanley.Miao <stanley.miao@windriver.com> > --- > drivers/mtd/nand/nand_base.c | 69 ++++++++++++++++++++++------------------- > 1 files changed, 37 insertions(+), 32 deletions(-) > > diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c > index 8f2958f..29e2a06 100644 > --- a/drivers/mtd/nand/nand_base.c > +++ b/drivers/mtd/nand/nand_base.c > @@ -2113,40 +2113,9 @@ static int nand_write(struct mtd_info *mtd, loff_t to, size_t len, > static int nand_do_write_oob(struct mtd_info *mtd, loff_t to, > struct mtd_oob_ops *ops) > { ... > @@ -2203,6 +2172,42 @@ static int nand_write_oob(struct mtd_info *mtd, loff_t to, > return -EINVAL; > } > > + if (ops->oobbuf) { > + int len; > + DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, ooblen = %i\n", > + __func__, (unsigned int)to, (int)ops->ooblen); Why this check is not done for !obs->oobbuf cas as well?
On Mon, 2010-02-15 at 16:07 +0200, Artem Bityutskiy wrote: > On Thu, 2010-02-04 at 15:18 +0800, Stanley.Miao wrote: > > nand_write_oob will invoke nand_do_write_oob or nand_do_write_ops depending > > on if ops->datbuf is NULL. nand_do_write_oob checked the validity of oob > > but nand_do_write_ops didn't. Now move the check into nand_write_oob to > > ensure the validity of oobbuf. > > > > Signed-off-by: Stanley.Miao <stanley.miao@windriver.com> > > --- > > drivers/mtd/nand/nand_base.c | 69 ++++++++++++++++++++++------------------- > > 1 files changed, 37 insertions(+), 32 deletions(-) > > > > diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c > > index 8f2958f..29e2a06 100644 > > --- a/drivers/mtd/nand/nand_base.c > > +++ b/drivers/mtd/nand/nand_base.c > > @@ -2113,40 +2113,9 @@ static int nand_write(struct mtd_info *mtd, loff_t to, size_t len, > > static int nand_do_write_oob(struct mtd_info *mtd, loff_t to, > > struct mtd_oob_ops *ops) > > { > > ... > > > @@ -2203,6 +2172,42 @@ static int nand_write_oob(struct mtd_info *mtd, loff_t to, > > return -EINVAL; > > } > > > > + if (ops->oobbuf) { > > + int len; > > + DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, ooblen = %i\n", > > + __func__, (unsigned int)to, (int)ops->ooblen); > > Why this check is not done for !obs->oobbuf cas as well? > > I address this and other problems in my patchset, please test if it works. Best regards, Maxim Levitsky
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c index 8f2958f..29e2a06 100644 --- a/drivers/mtd/nand/nand_base.c +++ b/drivers/mtd/nand/nand_base.c @@ -2113,40 +2113,9 @@ static int nand_write(struct mtd_info *mtd, loff_t to, size_t len, static int nand_do_write_oob(struct mtd_info *mtd, loff_t to, struct mtd_oob_ops *ops) { - int chipnr, page, status, len; + int chipnr, page, status; struct nand_chip *chip = mtd->priv; - DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n", - __func__, (unsigned int)to, (int)ops->ooblen); - - if (ops->mode == MTD_OOB_AUTO) - len = chip->ecc.layout->oobavail; - else - len = mtd->oobsize; - - /* Do not allow write past end of page */ - if ((ops->ooboffs + ops->ooblen) > len) { - DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt to write " - "past end of page\n", __func__); - return -EINVAL; - } - - if (unlikely(ops->ooboffs >= len)) { - DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt to start " - "write outside oob\n", __func__); - return -EINVAL; - } - - /* Do not allow reads past end of device */ - if (unlikely(to >= mtd->size || - ops->ooboffs + ops->ooblen > - ((mtd->size >> chip->page_shift) - - (to >> chip->page_shift)) * len)) { - DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt write beyond " - "end of device\n", __func__); - return -EINVAL; - } - chipnr = (int)(to >> chip->chip_shift); chip->select_chip(mtd, chipnr); @@ -2203,6 +2172,42 @@ static int nand_write_oob(struct mtd_info *mtd, loff_t to, return -EINVAL; } + if (ops->oobbuf) { + int len; + DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, ooblen = %i\n", + __func__, (unsigned int)to, (int)ops->ooblen); + + if (ops->mode == MTD_OOB_AUTO) + len = chip->ecc.layout->oobavail; + else + len = mtd->oobsize; + + /* Do not allow write past end of page */ + if ((ops->ooboffs + ops->ooblen) > len) { + DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt to write " + "past end of page\n", __func__); + return -EINVAL; + } + + if (unlikely(ops->ooboffs >= len)) { + DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt to start " + "write outside oob\n", __func__); + return -EINVAL; + } + + /* Do not allow reads past end of device */ + if (unlikely(to >= mtd->size || + ops->ooboffs + ops->ooblen > + ((mtd->size >> chip->page_shift) - + (to >> chip->page_shift)) * len)) { + DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt write beyond " + "end of device\n", __func__); + return -EINVAL; + } + + + } + nand_get_device(chip, mtd, FL_WRITING); switch(ops->mode) {
nand_write_oob will invoke nand_do_write_oob or nand_do_write_ops depending on if ops->datbuf is NULL. nand_do_write_oob checked the validity of oob but nand_do_write_ops didn't. Now move the check into nand_write_oob to ensure the validity of oobbuf. Signed-off-by: Stanley.Miao <stanley.miao@windriver.com> --- drivers/mtd/nand/nand_base.c | 69 ++++++++++++++++++++++------------------- 1 files changed, 37 insertions(+), 32 deletions(-)