From patchwork Thu Oct 11 11:06:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 982398 X-Patchwork-Delegate: boris.brezillon@free-electrons.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=arndb.de Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="th5WHQ2R"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 42W7V60kydz9s9N for ; Thu, 11 Oct 2018 22:07:42 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=3s9ks+/I66WkcDcTaGfaImJjvod69D+/JIZSzoLImS8=; b=th5 WHQ2R9Ekf5JUydikoN720etXzX3gvrqNovLvuJxxe7o6B+k6GubukpmcMrJTQ7sCfe2mCO6aoqtDn daWjd3wmDzdEl4sFlPD5aR5RiLkpIPZ81qXXEEansbqtmPnXoIzax4DayVKxbOIeeDmpllddGxzJJ N6pxvnRBgYYdpkF+ijKiJGcYoocOHW9Sf6joUP5Wyj5eNOtO2i8w2u0vMTRbdsjR1nL3auYp4QFf1 K+hure01/0ZukSCfhYuiMz1OaE7/EQukmdarwN9qkfNIugJ7pFYyKytsl3OydBIBrweENK6uEggPE Wc4wH54oeK1wWVBN0ameizCNYq4eYSg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gAYoV-0005j5-AK; Thu, 11 Oct 2018 11:07:31 +0000 Received: from mout.kundenserver.de ([212.227.126.187]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1gAYo1-0005hB-L0 for linux-mtd@lists.infradead.org; Thu, 11 Oct 2018 11:07:29 +0000 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1N5mWp-1fcus62Hut-017HlG; Thu, 11 Oct 2018 13:06:41 +0200 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1N5mWp-1fcus62Hut-017HlG; Thu, 11 Oct 2018 13:06:41 +0200 From: Arnd Bergmann To: Boris Brezillon Subject: [PATCH 1/2] mtd: docg3: don't set conflicting BCH_CONST_PARAMS option Date: Thu, 11 Oct 2018 13:06:16 +0200 Message-Id: <20181011110639.2649053-1-arnd@arndb.de> X-Mailer: git-send-email 2.18.0 X-Provags-ID: V03:K1:2mIYcrEHCmuG7RUYybIDVljsxrxThacEvRjGsy7C+iWmgYoDRN4 Fc4JO24me2dWv7uoQV36UloA1IEbTFkC9ECIkizJwsrlM+77GBxLyN3vwgsbnbohoXnrL7I goFriQ+tVm/2GnPy0oUyJqz9mfbwTNsgfzbJjD3/dD/+p2DgBuoltBBG0IAMjHUdyBHbFSU RlCk5e6M56SragKm5LZjg== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1; V01:K0:PK0Z4HPl4ms=:owGKW24RaCPoD8cNnxpm9N czitPy4aSY4by8sOQMMThVVpHT6MaBJefjnFHDaV6IeTAyvb6XWLL+rerGokrJNAx6wRNlg8A DxH626uMHGsP1Ide88061WPOdTq2hf3R80OQkq7+U1z+mRh2llUWsxUX6Avd7/6G2KWZiW5UU y64nt9jUwplrn7DXL1z7Q1KN0ZGSAjg0v+y5bgOXNSCKy92VUEUca0ULMMMneVPnLmA0NP3D6 S+/rYo4NZ8+XsGtzroVSs/5LSUKqhkBz6893c8TBDs/nV6yn9OiMZ4CnKJW3sz1ii4j5MoFFu vfjOaM4iFPTZvIi2E8jIakneiLbU4e4HKB+2aPD8vwRr0el2ytB9dknZS6x9pwqtWrs4mBOcN mw922oDf0MaHbixDG1i5tKnuXyVNo/4l+fXwT7m4v+/O1xIBfH0R1494l7dyTFdOEdJtofNiC z3j7ofNqxLBxnRE3kafN3QnM/ocIXwhNNsCAreXV4SgZSRnfwR6cXdj9L/0U+my9b12YcVcOq ss3W9pNO+byZpNqVtxJwp+eh5D33oPnLtFWIaO0MOkQPvgnbhVNO4QsVoDgpxADgBVp77XNC1 4IHbwrSgkz7r1ph4VJcDLjjxLNpT+VRRg6McjJOIL4LowO7Q41o+JrOFtWZHoZ77OD95LdunN JKQIkqf9qojSmTF0q7lrUhr5fw3IMhNmDGbo0SVgySgwmlF4Y0evGnFqYHHU+S4u834A= X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181011_040702_026040_EFA759A7 X-CRM114-Status: GOOD ( 17.91 ) X-Spam-Score: -0.0 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [212.227.126.187 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [212.227.126.187 listed in wl.mailspike.net] X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Arnd Bergmann , Robert Jarzmik , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Marek Vasut , linux-mtd@lists.infradead.org, Richard Weinberger , Brian Norris , David Woodhouse MIME-Version: 1.0 Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org I noticed during the creation of another bugfix that the BCH_CONST_PARAMS option that is set by DOCG3 breaks setting variable parameters for any other users of the BCH library code. The only other user we have today is the MTD_NAND software BCH implementation (most flash controllers use hardware BCH these days and are not affected). I considered removing BCH_CONST_PARAMS entirely because of the inherent conflict, but according to the description in lib/bch.c there is a significant performance benefit in keeping it. To avoid the immediate problem of the conflict between MTD_NAND_BCH and DOCG3, this only sets the constant parameters if MTD_NAND_BCH is disabled, which should fix the problem for all cases that are affected. This should also work for all stable kernels. Note that there is only one machine that actually seems to use the DOCG3 driver (arch/arm/mach-pxa/mioa701.c), so most users should have the driver disabled, but it almost certainly shows up if we wanted to test random kernels on machines that use software BCH in MTD. Fixes: d13d19ece39f ("mtd: docg3: add ECC correction code") Cc: stable@vger.kernel.org Cc: Robert Jarzmik Signed-off-by: Arnd Bergmann --- drivers/mtd/devices/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig index e514d57a0419..aa983422aa97 100644 --- a/drivers/mtd/devices/Kconfig +++ b/drivers/mtd/devices/Kconfig @@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers" config MTD_DOCG3 tristate "M-Systems Disk-On-Chip G3" select BCH - select BCH_CONST_PARAMS + select BCH_CONST_PARAMS if !MTD_NAND_BCH select BITREVERSE help This provides an MTD device driver for the M-Systems DiskOnChip From patchwork Thu Oct 11 11:06:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 982399 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=arndb.de Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="VGcj5WAi"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 42W7Vj3B6mz9sC2 for ; Thu, 11 Oct 2018 22:08:13 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=fWyRCkPTNSkAr8fisbRtTSX8XPQvJw1CuOmSak7ePGo=; b=VGcj5WAiWIQVmtXCSJnIKfncT5 bxk4a4LU8EYP1M8Ctx/AHN8jVYgxVfpEH2MMT/laTvuSuucAqpvHFZXJs0NLt9mESEvhUoN4ADczI Fixye3kgWorZoQlJAhqvFJTT3Ag5tvm2bL/wX5vAf1NIE5jaBUV1o7Mxru1yAqcfs1zkwISfbVg6W FOk7yqu56DB7X93NGF+kAXaRM7u63AlTwXTix69I2nvn459JuWiJGQ8XGWcnI1E3xYNSw8PP+O1FV Rr/sdxVBwvE0QpAQgF6JNqOLpav3l2aXOFDP8LW2WPeI52I0slmSpt+Rxx9x4XJqJHKmVJqi8ayVC 6Yb9m/GA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gAYoy-0005xX-JP; Thu, 11 Oct 2018 11:08:00 +0000 Received: from mout.kundenserver.de ([212.227.126.135]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1gAYoc-0005il-Ep for linux-mtd@lists.infradead.org; Thu, 11 Oct 2018 11:07:53 +0000 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1MHGTI-1fxLOP1Pqy-00DGMP; Thu, 11 Oct 2018 13:07:17 +0200 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1MHGTI-1fxLOP1Pqy-00DGMP; Thu, 11 Oct 2018 13:07:17 +0200 From: Arnd Bergmann To: Boris Brezillon Subject: [PATCH 2/2] [v2] lib/bch: fix possible stack overrun Date: Thu, 11 Oct 2018 13:06:17 +0200 Message-Id: <20181011110639.2649053-2-arnd@arndb.de> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20181011110639.2649053-1-arnd@arndb.de> References: <20181011110639.2649053-1-arnd@arndb.de> X-Provags-ID: V03:K1:kRfMw9+KH0exXxdrQTRRgqf4YBLnY35RZa99T21k5OJgRvpEiAx uGJssXABaKecJWHMO+D1N2V8v85pEFOngBkgtI/By2jeoA1x4ELo0eeqhfLiFgqsjVPKPvm uixPKrH7J1UH1A/SOl5h0ORkWxo/iXBYp34xlADPykGRBLf+s9+IvGPpHn7n+w8pjIcc5oy vj/yB0jNGWYSbrkJ/Hugw== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1; V01:K0:4E1Qqhf+w2E=:LQjzbtYEaENIL7HdEozUGk aiCdLKfF4yZ5o7c9dLQ8QiKWEf35ihk+fgaM0rrFgUCnnJkL63z1C2uL5cecX+R8fDn4y5b8A oRTE7EX0Fhwqjr0J/3c5y6u4MJUAu5lhIDqbDL8BlXqRMEKj1WF35yHAtI6ci8LQofqvGdDY4 SfMNCeE/0EVg1SqMHi0TUwWSe1s9T0AYZssA8CoQmKo0N3Kn0u1dttEIi6JZxkGHuoNWSbNYd nV0ZDEdo/2350bESHtcH/tZeBhA0QYbuDnhksoua6RAd1nAJtBXAIaWwXXTPW5mQMofDQJvRH lLyhrXDMpCmenY9tNXj2+1grbPOUxwABdQq35Wex1kS658GKhRakO9/Iu7oix30Hs64N+kJtb iRDgfClxfq+xjoaJIT6Cjv1tjKbyLgVw+t0NB3lgkuGfZtOrWwK8jQQnaPYnYZD0TG91FonQD wA4crqfWPaPQl3fycOg05dWFA+h0dMi9f4IkpILyCAJnRWT8xeinzYQ3fgDX3/BBUtHQU0TdW Lp+gXRVHnbtPYxQB8hiyFokIpGQSPFiK6+rrLolQioT8KNHGvN1kTDCtjpANIlIeMu+ESp2M5 dM9m0IZVgKKttrKWKteWuSMUZlprO8SS+YC8qJHHoPEGVbM70eBKhR52HmEDUYxTNA14F/fX0 ZTYm6BlHzKwCFqyrLb9H4EZ4lxg+lmKnUauePr/xNTJDXAxygHJXdUXxzz3kg7vmQuQ0= X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181011_040738_827756_C023242A X-CRM114-Status: GOOD ( 19.75 ) X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [212.227.126.135 listed in list.dnswl.org] X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Arnd Bergmann , Robert Jarzmik , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Marek Vasut , linux-mtd@lists.infradead.org, Richard Weinberger , Ivan Djelic , Brian Norris , David Woodhouse MIME-Version: 1.0 Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The previous patch introduced very large kernel stack usage and a Makefile change to hide the warning about it. From what I can tell, a number of things went wrong here: - The BCH_MAX_T constant was set to the maximum value for 'n', not the maximum for 't', which is much smaller. - The stack usage is actually larger than the entire kernel stack on some architectures that can use 4KB stacks (m68k, sh, c6x), which leads to an immediate overrun. - The justification in the patch description claimed that nothing changed, however that is not the case even without the two points above: the configuration is machine specific, and most boards never use the maximum BCH_ECC_WORDS() length but instead have something much smaller. That maximum would only apply to machines that use both the maximum block size and the maximum ECC strength. The largest value for 't' that I could find is '32', which in turn leads to a 60 byte array instead of 2048 bytes. Making it '64' for future extension seems also worthwhile, with 120 bytes for the array. Anything larger won't fit into the OOB area on NAND flash. With that changed, the warning can be enabled again. Only linux-4.19+ contains the breakage, so this is only needed as a stable backport if it does not make it into the release. Fixes: 02361bc77888 ("lib/bch: Remove VLA usage") Reported-by: Ard Biesheuvel Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann --- v2: use larget MAX_T, and add a check to init_bch, as suggested by Boris --- lib/Makefile | 1 - lib/bch.c | 17 +++++++++++++---- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/lib/Makefile b/lib/Makefile index 37fbf6f23148..a74986ff2f73 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -122,7 +122,6 @@ obj-$(CONFIG_ZLIB_INFLATE) += zlib_inflate/ obj-$(CONFIG_ZLIB_DEFLATE) += zlib_deflate/ obj-$(CONFIG_REED_SOLOMON) += reed_solomon/ obj-$(CONFIG_BCH) += bch.o -CFLAGS_bch.o := $(call cc-option,-Wframe-larger-than=4500) obj-$(CONFIG_LZO_COMPRESS) += lzo/ obj-$(CONFIG_LZO_DECOMPRESS) += lzo/ obj-$(CONFIG_LZ4_COMPRESS) += lz4/ diff --git a/lib/bch.c b/lib/bch.c index 7b0f2006698b..5db6d3a4c8a6 100644 --- a/lib/bch.c +++ b/lib/bch.c @@ -79,20 +79,19 @@ #define GF_T(_p) (CONFIG_BCH_CONST_T) #define GF_N(_p) ((1 << (CONFIG_BCH_CONST_M))-1) #define BCH_MAX_M (CONFIG_BCH_CONST_M) +#define BCH_MAX_T (CONFIG_BCH_CONST_T) #else #define GF_M(_p) ((_p)->m) #define GF_T(_p) ((_p)->t) #define GF_N(_p) ((_p)->n) -#define BCH_MAX_M 15 +#define BCH_MAX_M 15 /* 2KB */ +#define BCH_MAX_T 64 /* 64 bit correction */ #endif -#define BCH_MAX_T (((1 << BCH_MAX_M) - 1) / BCH_MAX_M) - #define BCH_ECC_WORDS(_p) DIV_ROUND_UP(GF_M(_p)*GF_T(_p), 32) #define BCH_ECC_BYTES(_p) DIV_ROUND_UP(GF_M(_p)*GF_T(_p), 8) #define BCH_ECC_MAX_WORDS DIV_ROUND_UP(BCH_MAX_M * BCH_MAX_T, 32) -#define BCH_ECC_MAX_BYTES DIV_ROUND_UP(BCH_MAX_M * BCH_MAX_T, 8) #ifndef dbg #define dbg(_fmt, args...) do {} while (0) @@ -202,6 +201,9 @@ void encode_bch(struct bch_control *bch, const uint8_t *data, const uint32_t * const tab3 = tab2 + 256*(l+1); const uint32_t *pdata, *p0, *p1, *p2, *p3; + if (WARN_ON(r_bytes > sizeof(r))) + return; + if (ecc) { /* load ecc parity bytes into internal 32-bit buffer */ load_ecc8(bch, bch->ecc_buf, ecc); @@ -1285,6 +1287,13 @@ struct bch_control *init_bch(int m, int t, unsigned int prim_poly) */ goto fail; + if (t > BCH_MAX_T) + /* + * we can support larger than 64 bits if necessary, at the + * cost of higher stack usage. + */ + goto fail; + /* sanity checks */ if ((t < 1) || (m*t >= ((1 << m)-1))) /* invalid t value */