2023-05-18 09:30:55

by Tudor Ambarus

[permalink] [raw]
Subject: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes

We failed to initialize n_banks for spi-nor-generic flashes, which
caused a devide by zero when computing the bank_size.

By default we consider that all chips have a single bank. Initialize
the default number of banks for spi-nor-generic flashes. Even if the
bug is fixed with this simple initialization, check the n_banks value
before dividing so that we make sure this kind of bug won't occur again
if some other struct instance is created uninitialized.

Suggested-by: Todd Brandt <[email protected]>
Reported-by: Todd Brandt <[email protected]>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Tudor Ambarus <[email protected]>
---
drivers/mtd/spi-nor/core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 0bb0ad14a2fc..5f29fac8669a 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2018,6 +2018,7 @@ static const struct spi_nor_manufacturer *manufacturers[] = {

static const struct flash_info spi_nor_generic_flash = {
.name = "spi-nor-generic",
+ .n_banks = 1,
/*
* JESD216 rev A doesn't specify the page size, therefore we need a
* sane default.
@@ -2921,7 +2922,8 @@ static void spi_nor_late_init_params(struct spi_nor *nor)
if (nor->flags & SNOR_F_HAS_LOCK && !nor->params->locking_ops)
spi_nor_init_default_locking_ops(nor);

- nor->params->bank_size = div64_u64(nor->params->size, nor->info->n_banks);
+ if (nor->info->n_banks > 1)
+ params->bank_size = div64_u64(params->size, nor->info->n_banks);
}

/**
@@ -2987,6 +2989,7 @@ static void spi_nor_init_default_params(struct spi_nor *nor)
/* Set SPI NOR sizes. */
params->writesize = 1;
params->size = (u64)info->sector_size * info->n_sectors;
+ params->bank_size = params->size;
params->page_size = info->page_size;

if (!(info->flags & SPI_NOR_NO_FR)) {
--
2.40.1.606.ga4b1b128d6-goog



2023-05-19 00:06:05

by Todd Brandt

[permalink] [raw]
Subject: Re: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes

Looks good, tested and confirmed

Tested-by: Todd Brandt <[email protected]>

On Thu, 2023-05-18 at 08:54 +0000, Tudor Ambarus wrote:
> We failed to initialize n_banks for spi-nor-generic flashes, which
> caused a devide by zero when computing the bank_size.
>
> By default we consider that all chips have a single bank. Initialize
> the default number of banks for spi-nor-generic flashes. Even if the
> bug is fixed with this simple initialization, check the n_banks value
> before dividing so that we make sure this kind of bug won't occur
> again
> if some other struct instance is created uninitialized.
>
> Suggested-by: Todd Brandt <[email protected]>
> Reported-by: Todd Brandt <[email protected]>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
> Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
> Link:
> https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Tudor Ambarus <[email protected]>
> ---
> drivers/mtd/spi-nor/core.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 0bb0ad14a2fc..5f29fac8669a 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2018,6 +2018,7 @@ static const struct spi_nor_manufacturer
> *manufacturers[] = {
>
> static const struct flash_info spi_nor_generic_flash = {
> .name = "spi-nor-generic",
> + .n_banks = 1,
> /*
> * JESD216 rev A doesn't specify the page size, therefore we
> need a
> * sane default.
> @@ -2921,7 +2922,8 @@ static void spi_nor_late_init_params(struct
> spi_nor *nor)
> if (nor->flags & SNOR_F_HAS_LOCK && !nor->params->locking_ops)
> spi_nor_init_default_locking_ops(nor);
>
> - nor->params->bank_size = div64_u64(nor->params->size, nor-
> >info->n_banks);
> + if (nor->info->n_banks > 1)
> + params->bank_size = div64_u64(params->size, nor->info-
> >n_banks);
> }
>
> /**
> @@ -2987,6 +2989,7 @@ static void spi_nor_init_default_params(struct
> spi_nor *nor)
> /* Set SPI NOR sizes. */
> params->writesize = 1;
> params->size = (u64)info->sector_size * info->n_sectors;
> + params->bank_size = params->size;
> params->page_size = info->page_size;
>
> if (!(info->flags & SPI_NOR_NO_FR)) {


2023-05-22 08:50:59

by Miquel Raynal

[permalink] [raw]
Subject: Re: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes

Hi Tudor,

[email protected] wrote on Thu, 18 May 2023 08:54:40 +0000:

> We failed to initialize n_banks for spi-nor-generic flashes, which
> caused a devide by zero when computing the bank_size.
>
> By default we consider that all chips have a single bank. Initialize
> the default number of banks for spi-nor-generic flashes. Even if the
> bug is fixed with this simple initialization, check the n_banks value
> before dividing so that we make sure this kind of bug won't occur again
> if some other struct instance is created uninitialized.
>
> Suggested-by: Todd Brandt <[email protected]>
> Reported-by: Todd Brandt <[email protected]>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
> Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
> Link: https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Tudor Ambarus <[email protected]>
> ---
> drivers/mtd/spi-nor/core.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index 0bb0ad14a2fc..5f29fac8669a 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -2018,6 +2018,7 @@ static const struct spi_nor_manufacturer *manufacturers[] = {
>
> static const struct flash_info spi_nor_generic_flash = {
> .name = "spi-nor-generic",
> + .n_banks = 1,

I definitely missed that structure.

> /*
> * JESD216 rev A doesn't specify the page size, therefore we need a
> * sane default.
> @@ -2921,7 +2922,8 @@ static void spi_nor_late_init_params(struct spi_nor *nor)
> if (nor->flags & SNOR_F_HAS_LOCK && !nor->params->locking_ops)
> spi_nor_init_default_locking_ops(nor);
>
> - nor->params->bank_size = div64_u64(nor->params->size, nor->info->n_banks);
> + if (nor->info->n_banks > 1)
> + params->bank_size = div64_u64(params->size, nor->info->n_banks);

I'm fine with the check as it is written because it also look like an
optimization, but bank_size should never be 0 otherwise it's a real bug
that must be catch and fixed. We do not want uninitialized bank_size's.

> }
>
> /**
> @@ -2987,6 +2989,7 @@ static void spi_nor_init_default_params(struct spi_nor *nor)
> /* Set SPI NOR sizes. */
> params->writesize = 1;
> params->size = (u64)info->sector_size * info->n_sectors;
> + params->bank_size = params->size;
> params->page_size = info->page_size;

We actually discarded that line in a previous discussion:
https://lore.kernel.org/linux-mtd/[email protected]/T/#mcb4f90f7ca48ffe3d9838b2ac6f74e44460c51bd

I'm fine to re-add it though, it does not hurt.

>
> if (!(info->flags & SPI_NOR_NO_FR)) {

Reviewed-by: Miquel Raynal <[email protected]>

Thanks,
Miquèl

2023-05-22 09:30:33

by Tudor Ambarus

[permalink] [raw]
Subject: Re: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes



On 5/22/23 09:29, Miquel Raynal wrote:
> Hi Tudor,

Hi, Miquel,

>
> [email protected] wrote on Thu, 18 May 2023 08:54:40 +0000:
>
>> We failed to initialize n_banks for spi-nor-generic flashes, which
>> caused a devide by zero when computing the bank_size.
>>
>> By default we consider that all chips have a single bank. Initialize
>> the default number of banks for spi-nor-generic flashes. Even if the
>> bug is fixed with this simple initialization, check the n_banks value
>> before dividing so that we make sure this kind of bug won't occur again
>> if some other struct instance is created uninitialized.
>>
>> Suggested-by: Todd Brandt <[email protected]>
>> Reported-by: Todd Brandt <[email protected]>
>> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
>> Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
>> Link: https://lore.kernel.org/all/[email protected]/
>> Signed-off-by: Tudor Ambarus <[email protected]>
>> ---
>> drivers/mtd/spi-nor/core.c | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
>> index 0bb0ad14a2fc..5f29fac8669a 100644
>> --- a/drivers/mtd/spi-nor/core.c
>> +++ b/drivers/mtd/spi-nor/core.c
>> @@ -2018,6 +2018,7 @@ static const struct spi_nor_manufacturer *manufacturers[] = {
>>
>> static const struct flash_info spi_nor_generic_flash = {
>> .name = "spi-nor-generic",
>> + .n_banks = 1,
>
> I definitely missed that structure.
>
>> /*
>> * JESD216 rev A doesn't specify the page size, therefore we need a
>> * sane default.
>> @@ -2921,7 +2922,8 @@ static void spi_nor_late_init_params(struct spi_nor *nor)
>> if (nor->flags & SNOR_F_HAS_LOCK && !nor->params->locking_ops)
>> spi_nor_init_default_locking_ops(nor);
>>
>> - nor->params->bank_size = div64_u64(nor->params->size, nor->info->n_banks);
>> + if (nor->info->n_banks > 1)
>> + params->bank_size = div64_u64(params->size, nor->info->n_banks);
>
> I'm fine with the check as it is written because it also look like an
> optimization, but bank_size should never be 0 otherwise it's a real bug

bank_size was introduced just for chips featuring several banks, but we
made this field mandatory for all flashes, regardless of their type. I
find this restriction unnecessary, because we can differentiate the RWW
flashes by checking the SNOR_F_RWW flag. So the alternative to this
patch is to remove the n_banks restriction and set it just for the RWW
flashes. I think I prefer this, but keep in mind that I never read a RWW
flash's datasheet, not publicly available, so the decision is in your
court. Happy to make a patch.

> that must be catch and fixed. We do not want uninitialized bank_size's.>
>> }
>>
>> /**
>> @@ -2987,6 +2989,7 @@ static void spi_nor_init_default_params(struct spi_nor *nor)
>> /* Set SPI NOR sizes. */
>> params->writesize = 1;
>> params->size = (u64)info->sector_size * info->n_sectors;
>> + params->bank_size = params->size;
>> params->page_size = info->page_size;
>
> We actually discarded that line in a previous discussion:
> https://lore.kernel.org/linux-mtd/[email protected]/T/#mcb4f90f7ca48ffe3d9838b2ac6f74e44460c51bd
>
> I'm fine to re-add it though, it does not hurt.

we would get rid of this init as well with my suggestion.

Keep in mind that the bug was introduced in 6.4, so we'll have to fix
this fast, let's come to an agreement.

Cheers,
ta
>
>>
>> if (!(info->flags & SPI_NOR_NO_FR)) {
>
> Reviewed-by: Miquel Raynal <[email protected]>
>
> Thanks,
> Miquèl

2023-05-22 09:52:46

by Hans de Goede

[permalink] [raw]
Subject: Re: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes

Hi,

On 5/22/23 11:22, Tudor Ambarus wrote:
>
>
> On 5/22/23 09:29, Miquel Raynal wrote:
>> Hi Tudor,
>
> Hi, Miquel,
>
>>
>> [email protected] wrote on Thu, 18 May 2023 08:54:40 +0000:
>>
>>> We failed to initialize n_banks for spi-nor-generic flashes, which
>>> caused a devide by zero when computing the bank_size.
>>>
>>> By default we consider that all chips have a single bank. Initialize
>>> the default number of banks for spi-nor-generic flashes. Even if the
>>> bug is fixed with this simple initialization, check the n_banks value
>>> before dividing so that we make sure this kind of bug won't occur again
>>> if some other struct instance is created uninitialized.
>>>
>>> Suggested-by: Todd Brandt <[email protected]>
>>> Reported-by: Todd Brandt <[email protected]>
>>> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
>>> Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
>>> Link: https://lore.kernel.org/all/[email protected]/
>>> Signed-off-by: Tudor Ambarus <[email protected]>
>>> ---
>>> drivers/mtd/spi-nor/core.c | 5 ++++-
>>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
>>> index 0bb0ad14a2fc..5f29fac8669a 100644
>>> --- a/drivers/mtd/spi-nor/core.c
>>> +++ b/drivers/mtd/spi-nor/core.c
>>> @@ -2018,6 +2018,7 @@ static const struct spi_nor_manufacturer *manufacturers[] = {
>>>
>>> static const struct flash_info spi_nor_generic_flash = {
>>> .name = "spi-nor-generic",
>>> + .n_banks = 1,
>>
>> I definitely missed that structure.
>>
>>> /*
>>> * JESD216 rev A doesn't specify the page size, therefore we need a
>>> * sane default.
>>> @@ -2921,7 +2922,8 @@ static void spi_nor_late_init_params(struct spi_nor *nor)
>>> if (nor->flags & SNOR_F_HAS_LOCK && !nor->params->locking_ops)
>>> spi_nor_init_default_locking_ops(nor);
>>>
>>> - nor->params->bank_size = div64_u64(nor->params->size, nor->info->n_banks);
>>> + if (nor->info->n_banks > 1)
>>> + params->bank_size = div64_u64(params->size, nor->info->n_banks);
>>
>> I'm fine with the check as it is written because it also look like an
>> optimization, but bank_size should never be 0 otherwise it's a real bug
>
> bank_size was introduced just for chips featuring several banks, but we
> made this field mandatory for all flashes, regardless of their type. I
> find this restriction unnecessary, because we can differentiate the RWW
> flashes by checking the SNOR_F_RWW flag. So the alternative to this
> patch is to remove the n_banks restriction and set it just for the RWW
> flashes. I think I prefer this, but keep in mind that I never read a RWW
> flash's datasheet, not publicly available, so the decision is in your
> court. Happy to make a patch.

Since this is causing a serious regression causing people's laptops to hang
on suspend I believe it would be best to queue up the simplest fix for
this (which seems to be this patch as is) for 6.4 asap.

Any more involved changes to fix this in a better way can then be added
on top for the 6.5 cycle.

Regards,

Hans



>
>> that must be catch and fixed. We do not want uninitialized bank_size's.>
>>> }
>>>
>>> /**
>>> @@ -2987,6 +2989,7 @@ static void spi_nor_init_default_params(struct spi_nor *nor)
>>> /* Set SPI NOR sizes. */
>>> params->writesize = 1;
>>> params->size = (u64)info->sector_size * info->n_sectors;
>>> + params->bank_size = params->size;
>>> params->page_size = info->page_size;
>>
>> We actually discarded that line in a previous discussion:
>> https://lore.kernel.org/linux-mtd/[email protected]/T/#mcb4f90f7ca48ffe3d9838b2ac6f74e44460c51bd
>>
>> I'm fine to re-add it though, it does not hurt.
>
> we would get rid of this init as well with my suggestion.
>
> Keep in mind that the bug was introduced in 6.4, so we'll have to fix
> this fast, let's come to an agreement.
>
> Cheers,
> ta
>>
>>>
>>> if (!(info->flags & SPI_NOR_NO_FR)) {
>>
>> Reviewed-by: Miquel Raynal <[email protected]>
>>
>> Thanks,
>> Miquèl
>


2023-05-22 10:19:17

by Miquel Raynal

[permalink] [raw]
Subject: Re: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes

Hello,

[email protected] wrote on Mon, 22 May 2023 11:34:55 +0200:

> Hi,
>
> On 5/22/23 11:22, Tudor Ambarus wrote:
> >
> >
> > On 5/22/23 09:29, Miquel Raynal wrote:
> >> Hi Tudor,
> >
> > Hi, Miquel,
> >
> >>
> >> [email protected] wrote on Thu, 18 May 2023 08:54:40 +0000:
> >>
> >>> We failed to initialize n_banks for spi-nor-generic flashes, which
> >>> caused a devide by zero when computing the bank_size.
> >>>
> >>> By default we consider that all chips have a single bank. Initialize
> >>> the default number of banks for spi-nor-generic flashes. Even if the
> >>> bug is fixed with this simple initialization, check the n_banks value
> >>> before dividing so that we make sure this kind of bug won't occur again
> >>> if some other struct instance is created uninitialized.
> >>>
> >>> Suggested-by: Todd Brandt <[email protected]>
> >>> Reported-by: Todd Brandt <[email protected]>
> >>> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
> >>> Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
> >>> Link: https://lore.kernel.org/all/[email protected]/
> >>> Signed-off-by: Tudor Ambarus <[email protected]>
> >>> ---
> >>> drivers/mtd/spi-nor/core.c | 5 ++++-
> >>> 1 file changed, 4 insertions(+), 1 deletion(-)
> >>>
> >>> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> >>> index 0bb0ad14a2fc..5f29fac8669a 100644
> >>> --- a/drivers/mtd/spi-nor/core.c
> >>> +++ b/drivers/mtd/spi-nor/core.c
> >>> @@ -2018,6 +2018,7 @@ static const struct spi_nor_manufacturer *manufacturers[] = {
> >>>
> >>> static const struct flash_info spi_nor_generic_flash = {
> >>> .name = "spi-nor-generic",
> >>> + .n_banks = 1,
> >>
> >> I definitely missed that structure.
> >>
> >>> /*
> >>> * JESD216 rev A doesn't specify the page size, therefore we need a
> >>> * sane default.
> >>> @@ -2921,7 +2922,8 @@ static void spi_nor_late_init_params(struct spi_nor *nor)
> >>> if (nor->flags & SNOR_F_HAS_LOCK && !nor->params->locking_ops)
> >>> spi_nor_init_default_locking_ops(nor);
> >>>
> >>> - nor->params->bank_size = div64_u64(nor->params->size, nor->info->n_banks);
> >>> + if (nor->info->n_banks > 1)
> >>> + params->bank_size = div64_u64(params->size, nor->info->n_banks);
> >>
> >> I'm fine with the check as it is written because it also look like an
> >> optimization, but bank_size should never be 0 otherwise it's a real bug
> >
> > bank_size was introduced just for chips featuring several banks, but we
> > made this field mandatory for all flashes, regardless of their type. I
> > find this restriction unnecessary, because we can differentiate the RWW
> > flashes by checking the SNOR_F_RWW flag. So the alternative to this
> > patch is to remove the n_banks restriction and set it just for the RWW
> > flashes. I think I prefer this, but keep in mind that I never read a RWW
> > flash's datasheet, not publicly available, so the decision is in your
> > court. Happy to make a patch.
>
> Since this is causing a serious regression causing people's laptops to hang
> on suspend I believe it would be best to queue up the simplest fix for
> this (which seems to be this patch as is) for 6.4 asap.
>
> Any more involved changes to fix this in a better way can then be added
> on top for the 6.5 cycle.

Absolutely. I actually am totally fine with the current state, I
believe expecting all flashes to have one bank is sane, that's why I
took this path in the first place. But this can be changed later
anyway.

Thanks,
Miquèl

2023-05-22 16:03:16

by Miquel Raynal

[permalink] [raw]
Subject: Re: [PATCH] mtd: spi-nor: Fix divide by zero for spi-nor-generic flashes

On Thu, 2023-05-18 at 08:54:40 UTC, Tudor Ambarus wrote:
> We failed to initialize n_banks for spi-nor-generic flashes, which
> caused a devide by zero when computing the bank_size.
>
> By default we consider that all chips have a single bank. Initialize
> the default number of banks for spi-nor-generic flashes. Even if the
> bug is fixed with this simple initialization, check the n_banks value
> before dividing so that we make sure this kind of bug won't occur again
> if some other struct instance is created uninitialized.
>
> Suggested-by: Todd Brandt <[email protected]>
> Reported-by: Todd Brandt <[email protected]>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217448
> Fixes: 9d6c5d64f028 ("mtd: spi-nor: Introduce the concept of bank")
> Link: https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Tudor Ambarus <[email protected]>
> Tested-by: Todd Brandt <[email protected]>
> Reviewed-by: Miquel Raynal <[email protected]>

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/fixes, thanks.

Miquel