linux/drivers/mtd/chips
Linus Walleij 565fe15062 mtd: cfi_cmdset_0001: Byte swap OTP info
Currently the offset into the device when looking for OTP
bits can go outside of the address of the MTD NOR devices,
and if that memory isn't readable, bad things happen
on the IXP4xx (added prints that illustrate the problem before
the crash):

cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100
ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78
cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000
ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78
8<--- cut here ---
Unable to handle kernel paging request at virtual address db000000
[db000000] *pgd=00000000
(...)

This happens in this case because the IXP4xx is big endian and
the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not
properly byteswapped. Compare to how the code in read_pri_intelext()
byteswaps the fields in struct cfi_pri_intelext.

Adding a small byte swapping loop for the OTP in read_pri_intelext()
and the crash goes away.

The problem went unnoticed for many years until I enabled
CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug.

Cc: stable@vger.kernel.org
Reviewed-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20231020-mtd-otp-byteswap-v4-1-0d132c06aa9d@linaro.org
2023-10-27 19:45:11 +02:00
..
cfi_cmdset_0001.c mtd: cfi_cmdset_0001: Byte swap OTP info 2023-10-27 19:45:11 +02:00
cfi_cmdset_0002.c mfd: Explicitly include correct DT includes 2023-08-18 21:48:03 +01:00
cfi_cmdset_0020.c mtd: chips: Use SPDX license headers 2023-06-09 17:27:11 +02:00
cfi_probe.c mtd: chips: Use SPDX license headers 2023-06-09 17:27:11 +02:00
cfi_util.c mtd: chips: Use SPDX license headers 2023-06-09 17:27:11 +02:00
chipreg.c mtd: Convert list_for_each to entry variant 2021-06-11 21:05:06 +02:00
fwh_lock.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
gen_probe.c mtd: chips: Use SPDX license headers 2023-06-09 17:27:11 +02:00
jedec_probe.c mtd: chips: Use SPDX license headers 2023-06-09 17:27:11 +02:00
Kconfig mtd: fixup CFI on ixp4xx 2021-10-15 12:27:10 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
map_absent.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
map_ram.c mtd: map_ram: prevent use of point and unpoint when NO_XIP is set 2023-09-22 16:33:34 +02:00
map_rom.c mtd: chips: Use SPDX license headers 2023-06-09 17:27:11 +02:00