From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751607AbcGRIqa (ORCPT ); Mon, 18 Jul 2016 04:46:30 -0400 Received: from mail1.bemta8.messagelabs.com ([216.82.243.206]:21091 "EHLO mail1.bemta8.messagelabs.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750973AbcGRIq1 (ORCPT ); Mon, 18 Jul 2016 04:46:27 -0400 X-Greylist: delayed 408 seconds by postgrey-1.27 at vger.kernel.org; Mon, 18 Jul 2016 04:46:27 EDT X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrAIsWRWlGSWpSXmKPExsXi5LtOQPfE1J5 wg3evJS0OvFjIYnF51xw2i91Ny9gtuvoWsVlM3vmG0WLBxkeMDmweV3+dZPd4sukio8fmJfUe N+cVenzeJBfAGsWamZeUX5HAmjHlxkvWgnvcFTumr2BuYHzB2cXIxSEksJpR4tnjGywQzhpGi dMXXjFDOBsYJX7OXwKU4eRgEzCQmHJ9GpgtIuAs8WHxDyYQm1mglVGipz0fxBYWcJP4sGEKI4 jNIqAq0bViEzuIzSvgLtFxdyFQLweHhICcxIL3PhBhQYmTM5+wQIyRkDj44gUziC0E1Drv8yZ WEFtCQEHi7J6/TBC2icTFq7vZIGxDie+zvrFA2NISe/sWMk9gFJyFZOwsJGMXMDKtYlQvTi0q Sy3SNdZLKspMzyjJTczM0TU0sNDLTS0uTkxPzUlMKtZLzs/dxAgMeQYg2MG4/5/TIUZJDiYlU d4mhZ5wIb6k/JTKjMTijPii0pzU4kOMMhwcShK826cA5QSLUtNTK9Iyc4DRB5OW4OBREuEVBE nzFhck5hZnpkOkTjEqSonzLgFJCIAkMkrz4NpgEX+JUVZKmJcR6BAhnoLUotzMElT5V4ziHIx KwrwXQKbwZOaVwE1/BbSYCWixgWo3yOKSRISUVAOjolLc+ZPTzoZ56576eOzi5gSGgwZim24p /QxX/WuU5agz0Xd/w/tCBjZWv54ny++9P+tvlHR8Xlfblas7Oa4KsLnkTVf6xrJn5/uKv48VA p/2xKbd/Gm+o85I/amaEaOPgr7+dMu3Uj+rxVPPSxrwRm/a8dCxXPq0sxt76/zmuSkh1jqOjW uUWIozEg21mIuKEwFMFXCy8wIAAA== X-Env-Sender: Hector.Palacios@digi.com X-Msg-Ref: server-2.tower-75.messagelabs.com!1468831176!24730901!1 X-Originating-IP: [66.77.174.16] X-StarScan-Received: X-StarScan-Version: 8.46; banners=-,-,- X-VirusChecked: Checked From: Hector Palacios To: , CC: , , , , Subject: [PATCH] mtd: nand: fix bug writing 1 byte less than page size Date: Mon, 18 Jul 2016 10:39:18 +0200 Message-ID: <1468831158-6172-1-git-send-email-hector.palacios@digi.com> X-Mailer: git-send-email 2.7.3 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.101.2.202] X-KSE-AntiSpam-Interceptor-Info: protection disabled X-KSE-Antivirus-Interceptor-Info: scan successful X-KSE-Antivirus-Info: Clean Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org nand_do_write_ops() determines if it is writing a partial page with the formula: part_pagewr = (column || writelen < (mtd->writesize - 1)) When 'writelen' is exactly 1 byte less than the NAND page size the formula equates to zero, so the code doesn't process it as a partial write, although it should. As a consequence the function remains in the while(1) loop with 'writelen' becoming 0xffffffff and iterating endlessly. The bug may not be easy to reproduce in Linux since user space tools usually force the padding or round-up the write size to a page-size multiple. This was discovered in U-Boot where the issue can be reproduced by writing any size that is 1 byte less than a page-size multiple. For example, on a NAND with 2K page (0x800): => nand erase.part => nand write $loadaddr 7ff Signed-off-by: Hector Palacios --- drivers/mtd/nand/nand_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c index 0b0dc29d2af7..77533f7f2429 100644 --- a/drivers/mtd/nand/nand_base.c +++ b/drivers/mtd/nand/nand_base.c @@ -2610,7 +2610,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to, int cached = writelen > bytes && page != blockmask; uint8_t *wbuf = buf; int use_bufpoi; - int part_pagewr = (column || writelen < (mtd->writesize - 1)); + int part_pagewr = (column || writelen < mtd->writesize); if (part_pagewr) use_bufpoi = 1;