Linus Walleij 123bc8641e mtd: jedec_probe: Fix crash in jedec_read_mfr() ... commit 87a73eb5b5 upstream. It turns out that the loop where we read manufacturer jedec_read_mfd() can under some circumstances get a CFI_MFR_CONTINUATION repeatedly, making the loop go over all banks and eventually hit the end of the map and crash because of an access violation: Unable to handle kernel paging request at virtual address c4980000 pgd = (ptrval) [c4980000] *pgd=03808811, *pte=00000000, *ppte=00000000 Internal error: Oops: 7 [#1] PREEMPT ARM CPU: 0 PID: 1 Comm: swapper Not tainted 4.16.0-rc1+ #150 Hardware name: Gemini (Device Tree) PC is at jedec_probe_chip+0x6ec/0xcd0 LR is at 0x4 pc : [<c03a2bf4>] lr : [<00000004>] psr: 60000013 sp : c382dd18 ip : 0000ffff fp : 00000000 r10: c0626388 r9 : 00020000 r8 : c0626340 r7 : 00000000 r6 : 00000001 r5 : c3a71afc r4 : c382dd70 r3 : 00000001 r2 : c4900000 r1 : 00000002 r0 : 00080000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 0000397f Table: 00004000 DAC: 00000053 Process swapper (pid: 1, stack limit = 0x(ptrval)) Fix this by breaking the loop with a return 0 if the offset exceeds the map size. Fixes: 5c9c11e1c4 ("[MTD] [NOR] Add support for flash chips with ID in bank other than 0") Cc: <stable@vger.kernel.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-04-08 11:51:55 +02:00
..
chips	mtd: jedec_probe: Fix crash in jedec_read_mfr()	2018-04-08 11:51:55 +02:00
devices	MTD updates for 4.4-rc1:	2015-11-06 11:50:24 -08:00
lpddr	mtd: lpddr: show parent device in sysfs	2015-10-13 09:21:17 -07:00
maps	mtd: maps: add __init attribute	2018-02-25 11:03:44 +01:00
nand	mtd: nand: fsl_ifc: Fix nand waitfunc return value	2018-03-28 18:40:15 +02:00
onenand	mtd: onenand: fix deadlock in onenand_block_markbad	2016-04-12 09:09:05 -07:00
spi-nor	mtd: spi-nor: fix spansion quad enable	2017-06-29 12:48:52 +02:00
tests	mtd: tests: Replace timeval with ktime_t	2015-10-26 13:23:47 -07:00
ubi	ubi: Fix race condition between ubi volume creation and udev	2018-03-18 11:17:52 +01:00
afs.c
ar7part.c
bcm47xxpart.c	mtd: bcm47xxpart: don't fail because of bit-flips	2017-07-05 14:37:18 +02:00
bcm63xxpart.c
cmdlinepart.c	mtd: cmdlinepart: convert printk() to pr_*()	2015-09-28 18:37:32 -07:00
ftl.c
inftlcore.c
inftlmount.c
Kconfig	mtd: part: Create the master device node when partitioned	2015-04-05 17:44:01 -07:00
Makefile
mtd_blkdevs.c	mtd: blkdevs: fix potential deadlock + lockdep warnings	2015-10-30 17:24:43 -07:00
mtdblock_ro.c
mtdblock.c
mtdchar.c	mtd: provide proper 32/64-bit compat_ioctl() support for BLKPG	2015-09-29 13:37:04 -07:00
mtdconcat.c
mtdcore.c	mtd: fix cmdlinepart parser, early naming for auto-filled MTD	2016-01-04 10:54:18 -08:00
mtdcore.h
mtdoops.c
mtdpart.c	mtd: mtdpart: Do not fail mtd probe when parsing partitions fails	2015-10-26 18:43:48 -07:00
mtdsuper.c
mtdswap.c
nftlcore.c
nftlmount.c
ofpart.c	doc: dt: mtd: partitions: add compatible property to "partitions" node	2015-12-08 17:10:20 -08:00
redboot.c
rfd_ftl.c
sm_ftl.c
sm_ftl.h
ssfdc.c