diff options
Diffstat (limited to 'target/linux/generic/hack-4.19/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch')
-rw-r--r-- | target/linux/generic/hack-4.19/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch | 83 |
1 files changed, 0 insertions, 83 deletions
diff --git a/target/linux/generic/hack-4.19/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch b/target/linux/generic/hack-4.19/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch deleted file mode 100644 index 9f48ba1cff..0000000000 --- a/target/linux/generic/hack-4.19/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch +++ /dev/null @@ -1,83 +0,0 @@ -From c942c462411e4757aafba73bf13b5e5c7a4b62ca Mon Sep 17 00:00:00 2001 -From: Christian Lamparter <chunkeey@gmail.com> -Date: Sun, 23 Dec 2018 00:38:55 +0100 -Subject: [PATCH] mtd: rawnand: qcom: fix memory corruption that causes panic - -This patch fixes a memory corruption that occured in the -qcom-nandc driver since it was converted to nand_scan(). - -On boot, an affected device will panic from a NPE at a weird place: -| Unable to handle kernel NULL pointer dereference at virtual address 00000000 -| pgd = (ptrval) -| [00000000] *pgd=00000000 -| Internal error: Oops: 80000005 [#1] SMP ARM -| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0 -| Hardware name: Generic DT based system -| PC is at (null) -| LR is at nand_block_isbad+0x90/0xa4 -| pc : [<00000000>] lr : [<c0592240>] psr: 80000013 -| sp : cf839d40 ip : 00000000 fp : cfae9e20 -| r10: cf815810 r9 : 00000000 r8 : 00000000 -| r7 : 00000000 r6 : 00000000 r5 : 00000001 r4 : cf815810 -| r3 : 00000000 r2 : cfae9810 r1 : ffffffff r0 : cf815810 -| Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none -| Control: 10c5387d Table: 8020406a DAC: 00000051 -| Process swapper/0 (pid: 1, stack limit = 0x(ptrval)) -| [<c0592240>] (nand_block_isbad) from [<c0580a94>] (allocate_partition+0x7a0/0x7dc) -| [<c0580a94>] (allocate_partition) from [<c05811e4>] (add_mtd_partitions+0x58/0x10c) -| [<c05811e4>] (add_mtd_partitions) from [<c0581164>] (parse_mtd_partitions+0x310/0x338) -| [<c0581164>] (parse_mtd_partitions) from [<c057def4>] (mtd_device_parse_register+0x60/0x15c) -| [<c057def4>] (mtd_device_parse_register) from [<c059d274>] (qcom_nandc_probe+0x770/0x8f4) -| [<c059d274>] (qcom_nandc_probe) from [<c0567f00>] (platform_drv_probe+0x34/0x70) - -The problem is that the nand_scan()'s qcom_nand_attach_chip callback -is updating the nandc->max_cwperpage from 1 to 4. This causes the -sg_init_table of clear_bam_transaction() in the driver's -qcom_nandc_block_bad() to memset much more than what was initially -allocated by alloc_bam_transaction(). - -Hence, this patch restores the old behavior by performing the -alloc_bam_transaction() after the chip was identified. - -Fixes: 6a3cec64f18c ("mtd: rawnand: qcom: convert driver to nand_scan()") -Signed-off-by: Christian Lamparter <chunkeey@gmail.com> ---- - drivers/mtd/nand/raw/qcom_nandc.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - ---- a/drivers/mtd/nand/raw/qcom_nandc.c -+++ b/drivers/mtd/nand/raw/qcom_nandc.c -@@ -2839,6 +2839,16 @@ static int qcom_nand_host_init_and_regis - if (ret) - return ret; - -+ if (nandc->props->is_bam) { -+ free_bam_transaction(nandc); -+ nandc->bam_txn = alloc_bam_transaction(nandc); -+ if (!nandc->bam_txn) { -+ dev_err(nandc->dev, -+ "failed to allocate bam transaction\n"); -+ return -ENOMEM; -+ } -+ } -+ - ret = mtd_device_register(mtd, NULL, 0); - if (ret) - nand_cleanup(chip); -@@ -2853,16 +2863,6 @@ static int qcom_probe_nand_devices(struc - struct qcom_nand_host *host; - int ret; - -- if (nandc->props->is_bam) { -- free_bam_transaction(nandc); -- nandc->bam_txn = alloc_bam_transaction(nandc); -- if (!nandc->bam_txn) { -- dev_err(nandc->dev, -- "failed to allocate bam transaction\n"); -- return -ENOMEM; -- } -- } -- - for_each_available_child_of_node(dn, child) { - host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL); - if (!host) { |