81d9bdf590
This patch fixes a memory corruption that occurred in the
qcom-nandc driver since it was converted to nand_scan().
On boot, an affected device will panic from a NPE at a weird place:
| Unable to handle kernel NULL pointer dereference at virtual address 0
| pgd = (ptrval)
| [00000000] *pgd=00000000
| Internal error: Oops: 80000005 [#1] SMP ARM
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
| Hardware name: Generic DT based system
| PC is at (null)
| LR is at nand_block_isbad+0x90/0xa4
| pc : [<00000000>] lr : [<c0592240>] psr: 80000013
| sp : cf839d40 ip : 00000000 fp : cfae9e20
| r10: cf815810 r9 : 00000000 r8 : 00000000
| r7 : 00000000 r6 : 00000000 r5 : 00000001 r4 : cf815810
| r3 : 00000000 r2 : cfae9810 r1 : ffffffff r0 : cf815810
| Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
| Control: 10c5387d Table: 8020406a DAC: 00000051
| Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
| [<c0592240>] (nand_block_isbad) from [<c0580a94>]
| [<c0580a94>] (allocate_partition) from [<c05811e4>]
| [<c05811e4>] (add_mtd_partitions) from [<c0581164>]
| [<c0581164>] (parse_mtd_partitions) from [<c057def4>]
| [<c057def4>] (mtd_device_parse_register) from [<c059d274>]
| [<c059d274>] (qcom_nandc_probe) from [<c0567f00>]
The problem is that the nand_scan()'s qcom_nand_attach_chip callback
is updating the nandc->max_cwperpage from 1 to 4. This causes the
sg_init_table of clear_bam_transaction() in the driver's
qcom_nandc_block_bad() to memset much more than what was initially
allocated by alloc_bam_transaction().
This patch restores the old behavior by reallocating the shared bam
transaction alloc_bam_transaction() after the chip was identified,
but before mtd_device_parse_register() (which is an alias for
mtd_device_register() - see panic) gets called. This fixes the
corruption and the driver is working again.
Cc: stable@vger.kernel.org
Fixes:
|
||
---|---|---|
.. | ||
atmel | ||
bcm47xxnflash | ||
brcmnand | ||
gpmi-nand | ||
ams-delta.c | ||
au1550nd.c | ||
cafe_nand.c | ||
cmx270_nand.c | ||
cs553x_nand.c | ||
davinci_nand.c | ||
denali.c | ||
denali.h | ||
denali_dt.c | ||
denali_pci.c | ||
diskonchip.c | ||
fsl_elbc_nand.c | ||
fsl_ifc_nand.c | ||
fsl_upm.c | ||
fsmc_nand.c | ||
gpio.c | ||
hisi504_nand.c | ||
internals.h | ||
jz4740_nand.c | ||
jz4780_bch.c | ||
jz4780_bch.h | ||
jz4780_nand.c | ||
Kconfig | ||
lpc32xx_mlc.c | ||
lpc32xx_slc.c | ||
Makefile | ||
marvell_nand.c | ||
mpc5121_nfc.c | ||
mtk_ecc.c | ||
mtk_ecc.h | ||
mtk_nand.c | ||
mxc_nand.c | ||
nand_amd.c | ||
nand_base.c | ||
nand_bbt.c | ||
nand_bch.c | ||
nand_ecc.c | ||
nand_esmt.c | ||
nand_hynix.c | ||
nand_ids.c | ||
nand_jedec.c | ||
nand_legacy.c | ||
nand_macronix.c | ||
nand_micron.c | ||
nand_onfi.c | ||
nand_samsung.c | ||
nand_timings.c | ||
nand_toshiba.c | ||
nandsim.c | ||
ndfc.c | ||
nuc900_nand.c | ||
omap2.c | ||
omap_elm.c | ||
orion_nand.c | ||
oxnas_nand.c | ||
pasemi_nand.c | ||
plat_nand.c | ||
qcom_nandc.c | ||
r852.c | ||
r852.h | ||
s3c2410.c | ||
sh_flctl.c | ||
sharpsl.c | ||
sm_common.c | ||
sm_common.h | ||
socrates_nand.c | ||
sunxi_nand.c | ||
tango_nand.c | ||
tegra_nand.c | ||
tmio_nand.c | ||
txx9ndfmc.c | ||
vf610_nfc.c | ||
xway_nand.c |