From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout11.his.huawei.com (canpmsgout11.his.huawei.com [113.46.200.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFB81424642 for ; Thu, 16 Jul 2026 13:31:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.226 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784208714; cv=none; b=oL/zeTGYDO5e6w6K6z6rJ8qBLYYr12tqSyk5xn2iMPwJrezqdOGtObHWY4/S9k38qtSykfiYxKUZGVbcinRex9lKbc16Pr/+qD/xWZd+xldEfThlHDRPxpQDsAVVAaKLYs2gm8Knb2gL2l1ShRMll+3ZPFB4SCJneB7lbJpZ9CE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784208714; c=relaxed/simple; bh=igDGVYRAP29aP8gdSQO/xjtArYQVh5lgwgIiZ3wjuRg=; h=Subject:To:CC:References:From:Message-ID:Date:MIME-Version: In-Reply-To:Content-Type; b=ZjvrlWPzcU5geAn3RReUgXpOrNWgyP2GbSPqB2CI3NS5/nYSMvJfUjcMZAu2FT7qwWN4i2nCTB1H5DLO4P63Wio9lQiFMOw/xSAFW5jYrRZ5R7blsI9NHodR/3X1pGIXRPsTh8JOgMlZdI9E7n3aVrCXn4ap3eG3EJLyZI84V8g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=M85DbeYo; arc=none smtp.client-ip=113.46.200.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="M85DbeYo" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=cR6v39GwN2FtvxiI4Ocw284F8Ll4ovAOvUUd0k6wOoI=; b=M85DbeYodJNQo8awsFXH07LXVkLcspjU1igxnma94gOm5A85O5AIomJGV7iicA1hU+5vfd5pS s5i49yf1Q4tYnAnMRdBrhH7LalXINpidBKfMEHrvMW5RTuSdcimADb7PDNIUFCv314WH7+pjCvW Mc09DNEyt9tgqU4va3JBMCA= Received: from mail.maildlp.com (unknown [172.19.163.127]) by canpmsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4h1DH10Pg1zKm52; Thu, 16 Jul 2026 21:22:21 +0800 (CST) Received: from whupemo200011.china.huawei.com (unknown [7.152.185.179]) by mail.maildlp.com (Postfix) with ESMTPS id 97E43402AB; Thu, 16 Jul 2026 21:31:42 +0800 (CST) Received: from [10.174.178.46] (10.174.178.46) by whupemo200011.china.huawei.com (7.152.185.179) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 16 Jul 2026 21:31:41 +0800 Subject: Re: [PATCH] mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() To: zhouminqiang , , , , , CC: , , , References: <20260716131432.2355777-1-zhouminqiang2@huawei.com> From: Zhihao Cheng Message-ID: <3789ac0c-d9b0-99f8-4e5e-e10820e6518d@huawei.com> Date: Thu, 16 Jul 2026 21:31:40 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 In-Reply-To: <20260716131432.2355777-1-zhouminqiang2@huawei.com> Content-Type: text/plain; charset="gbk"; format=flowed Content-Transfer-Encoding: 8bit X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To whupemo200011.china.huawei.com (7.152.185.179) ÔÚ 2026/7/16 21:14, zhouminqiang дµÀ: > mtd_add_partition() does not reject the special offset value > MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in > add_mtd_device() when called through the BLKPG ioctl on NAND > devices. The RETAIN value depends on cur_offset being the end of > the previous partition, but in the dynamic partition path > cur_offset equals the offset argument itself, causing undefined > behavior. > > Commit 5daa7b21496a ("mtd: prepare partition add and del functions > for ioctl requests") introduced mtd_add_partition() and correctly > rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2), > since those special offsets rely on cur_offset tracking the > previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags > for partitions which should just leave smth. after them") > later added MTDPART_OFS_RETAIN (-3) for the static > partition table path without updating mtd_add_partition() to > also reject this value. > > With offset=-3 passed via BLKPG, the RETAIN size calculation in > allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD > = parent_size + 3). If the underflow result does not appear to > leave enough space, allocate_partition() jumps to out_register via > goto, skipping erasesize initialization. This results in > erasesize=0, which triggers: > > WARN_ON((!mtd->erasesize || !master->_erase) && > !(mtd->flags & MTD_NO_ERASE)) > > in add_mtd_device(). If the underflow result appears to leave > enough space, a bogus partition size is calculated, but the > "out of reach" sanity check catches the invalid offset and > creates a disabled empty partition (offset=0, size=0) instead > of returning an error. > > Fix this by adding MTDPART_OFS_RETAIN to the rejection list in > mtd_add_partition(), consistent with the existing handling of > APPEND and NXTBLK. > > Fixes: 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") > > Signed-off-by: zhouminqiang > --- > drivers/mtd/mtdpart.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Reviewed-by: Zhihao Cheng > > diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c > index 795a94e6b482..11cab777a1ac 100644 > --- a/drivers/mtd/mtdpart.c > +++ b/drivers/mtd/mtdpart.c > @@ -255,7 +255,8 @@ int mtd_add_partition(struct mtd_info *parent, const char *name, > > /* the direct offset is expected */ > if (offset == MTDPART_OFS_APPEND || > - offset == MTDPART_OFS_NXTBLK) > + offset == MTDPART_OFS_NXTBLK || > + offset == MTDPART_OFS_RETAIN) > return -EINVAL; > > if (length == MTDPART_SIZ_FULL) >