linux-stable/drivers/mtd
Thor Thayer 47016b341f mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic
The current Cadence QSPI driver caused a kernel panic when loading
a Root Filesystem from QSPI. The problem was caused by reading more
bytes than needed because the QSPI operated on 4 bytes at a time.
<snip>
[    7.947754] spi_nor_read[1048]:from 0x037cad74, len 1 [bfe07fff]
[    7.956247] cqspi_read[910]:offset 0x58502516, buffer=bfe07fff
[    7.956247]
[    7.966046] Unable to handle kernel paging request at virtual
address bfe08002
[    7.973239] pgd = eebfc000
[    7.975931] [bfe08002] *pgd=2fffb811, *pte=00000000, *ppte=00000000
</snip>
Notice above how only 1 byte needed to be read but by reading 4 bytes
into the end of a mapped page, an unrecoverable page fault occurred.

This patch uses a temporary buffer to hold the 4 bytes read and then
copies only the bytes required into the buffer. A min() function is
used to limit the length to prevent buffer overflows.

Request testing of this patch on other platforms. This was tested
on the Intel Arria10 SoCFPGA DevKit.

Fixes: 0cf1725676 ("mtd: spi-nor: cqspi: Fix build on arches missing readsl/writesl")
Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
2018-04-23 21:42:56 +02:00
..
chips MTD changes: 2018-04-06 12:15:41 -07:00
devices mtd: Stop updating erase_info->state and calling mtd_erase_callback() 2018-03-21 09:50:56 +01:00
lpddr mtd: Stop updating erase_info->state and calling mtd_erase_callback() 2018-03-21 09:50:56 +01:00
maps mtd: physmap_of: update struct map_info's swap as per map requirement 2018-03-29 09:31:37 +02:00
nand mtd: nand: Fix nanddev_mtd_erase() 2018-04-22 19:59:29 +02:00
parsers mtd: sharpslpart: make local function sharpsl_nand_cleanup_ftl() static 2018-01-06 15:06:23 +01:00
spi-nor mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic 2018-04-23 21:42:56 +02:00
tests mtd: tests: check erase block count in page test 2018-03-21 09:50:57 +01:00
ubi This pull request contains updates for both UBI and UBIFS: 2018-04-11 16:39:34 -07:00
afs.c
ar7part.c
bcm47xxpart.c mtd: extract TRX parser out of bcm47xxpart into a separated module 2017-06-22 13:13:10 -07:00
bcm63xxpart.c
cmdlinepart.c
ftl.c mtd: ftl: Use DIV_ROUND_UP() 2018-03-29 09:36:01 +02:00
inftlcore.c mtd: nand: Rename nand.h into rawnand.h 2017-08-13 10:11:49 +02:00
inftlmount.c mtd: Unconditionally update ->fail_addr and ->addr in part_erase() 2018-03-15 18:22:26 +01:00
Kconfig mtd: Move onenand code base to drivers/mtd/nand/onenand 2018-03-15 15:40:37 +01:00
Makefile mtd: Move onenand code base to drivers/mtd/nand/onenand 2018-03-15 15:40:37 +01:00
mtd_blkdevs.c block: Use blk_queue_flag_*() in drivers instead of queue_flag_*() 2018-03-08 14:13:48 -07:00
mtdblock.c mtd: Unconditionally update ->fail_addr and ->addr in part_erase() 2018-03-15 18:22:26 +01:00
mtdblock_ro.c
mtdchar.c MTD changes: 2018-04-06 12:15:41 -07:00
mtdconcat.c mtd: Stop updating erase_info->state and calling mtd_erase_callback() 2018-03-21 09:50:56 +01:00
mtdcore.c mtd: Fix some function description mismatches in mtdcore.c 2018-03-29 09:31:54 +02:00
mtdcore.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mtdoops.c mtd: Unconditionally update ->fail_addr and ->addr in part_erase() 2018-03-15 18:22:26 +01:00
mtdpart.c mtd: rename "ofpart" parser to "fixed-partitions" as it fits it better 2018-03-27 09:11:24 +02:00
mtdsuper.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
mtdswap.c mtd: Unconditionally update ->fail_addr and ->addr in part_erase() 2018-03-15 18:22:26 +01:00
nftlcore.c mtd: nand: Rename nand.h into rawnand.h 2017-08-13 10:11:49 +02:00
nftlmount.c mtd: nftl: use %*ph to print small buffer 2018-03-21 09:50:56 +01:00
ofpart.c mtd: ofpart: add of_match_table with "fixed-partitions" 2018-03-27 09:11:31 +02:00
redboot.c
rfd_ftl.c mtd: Unconditionally update ->fail_addr and ->addr in part_erase() 2018-03-15 18:22:26 +01:00
sm_ftl.c Core changes: 2018-04-04 22:11:36 +02:00
sm_ftl.h mtd: Stop assuming mtd_erase() is asynchronous 2018-03-15 18:21:07 +01:00
ssfdc.c mtd: nand: Rename nand.h into rawnand.h 2017-08-13 10:11:49 +02:00