summaryrefslogtreecommitdiff
path: root/Documentation/specialix.txt
diff options
context:
space:
mode:
authorLinus Walleij <linus.walleij@linaro.org>2018-03-04 01:29:03 +0300
committerBen Hutchings <ben@decadent.org.uk>2018-06-01 02:30:26 +0300
commit0b8479056e90225a9f913d7eee4876295989ca62 (patch)
treed3b09c2cbd97d80787c65db7fbaa945aa96a4347 /Documentation/specialix.txt
parentb9bae75805932048d0b5172cd63f83b28668eb02 (diff)
downloadlinux-0b8479056e90225a9f913d7eee4876295989ca62.tar.xz
mtd: jedec_probe: Fix crash in jedec_read_mfr()
commit 87a73eb5b56fd6e07c8e499fe8608ef2d8912b82 upstream. It turns out that the loop where we read manufacturer jedec_read_mfd() can under some circumstances get a CFI_MFR_CONTINUATION repeatedly, making the loop go over all banks and eventually hit the end of the map and crash because of an access violation: Unable to handle kernel paging request at virtual address c4980000 pgd = (ptrval) [c4980000] *pgd=03808811, *pte=00000000, *ppte=00000000 Internal error: Oops: 7 [#1] PREEMPT ARM CPU: 0 PID: 1 Comm: swapper Not tainted 4.16.0-rc1+ #150 Hardware name: Gemini (Device Tree) PC is at jedec_probe_chip+0x6ec/0xcd0 LR is at 0x4 pc : [<c03a2bf4>] lr : [<00000004>] psr: 60000013 sp : c382dd18 ip : 0000ffff fp : 00000000 r10: c0626388 r9 : 00020000 r8 : c0626340 r7 : 00000000 r6 : 00000001 r5 : c3a71afc r4 : c382dd70 r3 : 00000001 r2 : c4900000 r1 : 00000002 r0 : 00080000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 0000397f Table: 00004000 DAC: 00000053 Process swapper (pid: 1, stack limit = 0x(ptrval)) Fix this by breaking the loop with a return 0 if the offset exceeds the map size. Fixes: 5c9c11e1c47c ("[MTD] [NOR] Add support for flash chips with ID in bank other than 0") Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'Documentation/specialix.txt')
0 files changed, 0 insertions, 0 deletions