| Message ID | 30a41254ed09624a8972aa1daf14e4dd1efabed3.1531045014.git.cerg2010cerg2010@mail.ru |
|---|---|
| State | Changes Requested |
| Delegated to: | Miquel Raynal |
| Headers | show |
| Series | [1/2] mtd: rawnand: docg4: fix NULL deref while probing | expand |
Hi Sergey, Sergey Larin <cerg2010cerg2010@mail.ru> wrote on Sun, 8 Jul 2018 14:29:23 +0300: > nand_scan_tail() invokes nand_chip->scan_bbt() at the end, which is not set > by the driver. Use the default nand_default_bbt() function to avoid NULL > dereferncing. dereferencing > > Signed-off-by: Sergey Larin <cerg2010cerg2010@mail.ru> Maybe a Fixes/stable tags would be appropriate here if this is a real runtime error? > --- > drivers/mtd/nand/raw/docg4.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/mtd/nand/raw/docg4.c b/drivers/mtd/nand/raw/docg4.c > index bb96cb33cd6b..bbed8ea7858c 100644 > --- a/drivers/mtd/nand/raw/docg4.c > +++ b/drivers/mtd/nand/raw/docg4.c > @@ -1269,6 +1269,7 @@ static void __init init_mtd_structs(struct mtd_info *mtd) > nand->read_buf = docg4_read_buf; > nand->write_buf = docg4_write_buf16; > nand->erase = docg4_erase_block; > + nand->scan_bbt = nand_default_bbt; > nand->set_features = nand_get_set_features_notsupp; > nand->get_features = nand_get_set_features_notsupp; > nand->ecc.read_page = docg4_read_page;
On Sun, 8 Jul 2018 14:29:23 +0300 Sergey Larin <cerg2010cerg2010@mail.ru> wrote: > nand_scan_tail() invokes nand_chip->scan_bbt() at the end, which is not set > by the driver. Use the default nand_default_bbt() function to avoid NULL > dereferncing. Wow! For how long has this driver been broken? The ->scan_bbt() hook has been there for a very long time, and nand_scan_tail() is calling it when NAND_SKIP_BBTSCAN is not set. > > Signed-off-by: Sergey Larin <cerg2010cerg2010@mail.ru> Missing Fixes and Cc stable tags. > --- > drivers/mtd/nand/raw/docg4.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/mtd/nand/raw/docg4.c b/drivers/mtd/nand/raw/docg4.c > index bb96cb33cd6b..bbed8ea7858c 100644 > --- a/drivers/mtd/nand/raw/docg4.c > +++ b/drivers/mtd/nand/raw/docg4.c > @@ -1269,6 +1269,7 @@ static void __init init_mtd_structs(struct mtd_info *mtd) > nand->read_buf = docg4_read_buf; > nand->write_buf = docg4_write_buf16; > nand->erase = docg4_erase_block; > + nand->scan_bbt = nand_default_bbt; Are you sure that's really what you want. My experience with docg4 code is that it's not really fitting in the raw NAND framework, so I wouldn't be surprised if the default bad block table scan function does not match how the docg4 NAND works. > nand->set_features = nand_get_set_features_notsupp; > nand->get_features = nand_get_set_features_notsupp; > nand->ecc.read_page = docg4_read_page;
Hi Sergey,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on mtd/nand/next]
[also build test ERROR on v4.18-rc3 next-20180706]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Sergey-Larin/fix-regressions-in-DoC-G4-driver/20180708-193220
base: git://git.infradead.org/linux-mtd.git nand/next
config: i386-randconfig-s0-201827 (attached as .config)
compiler: gcc-6 (Debian 6.4.0-9) 6.4.0 20171026
reproduce:
# save the attached .config to linux build tree
make ARCH=i386
All errors (new ones prefixed by >>):
>> ERROR: "nand_default_bbt" [drivers/mtd/nand/raw/docg4.ko] undefined!
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
diff --git a/drivers/mtd/nand/raw/docg4.c b/drivers/mtd/nand/raw/docg4.c index bb96cb33cd6b..bbed8ea7858c 100644 --- a/drivers/mtd/nand/raw/docg4.c +++ b/drivers/mtd/nand/raw/docg4.c @@ -1269,6 +1269,7 @@ static void __init init_mtd_structs(struct mtd_info *mtd) nand->read_buf = docg4_read_buf; nand->write_buf = docg4_write_buf16; nand->erase = docg4_erase_block; + nand->scan_bbt = nand_default_bbt; nand->set_features = nand_get_set_features_notsupp; nand->get_features = nand_get_set_features_notsupp; nand->ecc.read_page = docg4_read_page;
nand_scan_tail() invokes nand_chip->scan_bbt() at the end, which is not set by the driver. Use the default nand_default_bbt() function to avoid NULL dereferncing. Signed-off-by: Sergey Larin <cerg2010cerg2010@mail.ru> --- drivers/mtd/nand/raw/docg4.c | 1 + 1 file changed, 1 insertion(+)