Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c1c5f19 authored by Baruch Siach's avatar Baruch Siach Committed by David Woodhouse
Browse files

mtd: mxc_nand: fix OOB corruption when page size > 2KiB 



When page size is 4KiB, ecc.total is set to 8*9, and this causes
nand_write_page_hwecc() to read past the initialized part of the eccpos array,
which corrupts chip->oob_poi with bogus values from ecc_calc.

Fix this by creating a proper nand_ecclayout for 4KiB flashes.

Signed-off-by: default avatarBaruch Siach <baruch@tkos.co.il>
Acked-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent f43272c4

drivers/mtd/nand/mxc_nand.c

+27 −0
Original line number Diff line number Diff line
@@ -211,6 +211,31 @@ static struct nand_ecclayout nandv2_hw_eccoob_largepage = { 
	}

};



/* OOB description for 4096 byte pages with 128 byte OOB */

static struct nand_ecclayout nandv2_hw_eccoob_4k = {

	.eccbytes = 8 * 9,

	.eccpos = {

		7,  8,  9, 10, 11, 12, 13, 14, 15,

		23, 24, 25, 26, 27, 28, 29, 30, 31,

		39, 40, 41, 42, 43, 44, 45, 46, 47,

		55, 56, 57, 58, 59, 60, 61, 62, 63,

		71, 72, 73, 74, 75, 76, 77, 78, 79,

		87, 88, 89, 90, 91, 92, 93, 94, 95,

		103, 104, 105, 106, 107, 108, 109, 110, 111,

		119, 120, 121, 122, 123, 124, 125, 126, 127,

	},

	.oobfree = {

		{.offset = 2, .length = 4},

		{.offset = 16, .length = 7},

		{.offset = 32, .length = 7},

		{.offset = 48, .length = 7},

		{.offset = 64, .length = 7},

		{.offset = 80, .length = 7},

		{.offset = 96, .length = 7},

		{.offset = 112, .length = 7},

	}

};



#ifdef CONFIG_MTD_PARTITIONS

static const char *part_probes[] = { "RedBoot", "cmdlinepart", NULL };

#endif
@@ -1186,6 +1211,8 @@ static int __init mxcnd_probe(struct platform_device *pdev) 


	if (mtd->writesize == 2048)

		this->ecc.layout = oob_largepage;

	if (nfc_is_v21() && mtd->writesize == 4096)

		this->ecc.layout = &nandv2_hw_eccoob_4k;



	/* second phase scan */

	if (nand_scan_tail(mtd)) {