Thread (19 messages) flat view 19 messages, 2 authors, 6d ago

Re: [PATCH v3 10/15] mtd: rawnand: sunxi: support randomized OOB formats

From: sashiko-bot@kernel.org
Date: 2026-09-09 08:44:54
Also in: linux-sunxi

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A divide by zero occurs when maximizing ECC strength for a 512-byte page NAND.
--

commit b0b5203da9f471c1f78c9b3ee0393b943af5ad6f
Author: James Hilliard [off-list ref]

    mtd: rawnand: sunxi: support randomized OOB formats

This commit adds support for randomized out-of-band (OOB) data formats on
Allwinner NAND controllers. It honors the allwinner,randomized-oob property
to keep the bad block marker in the randomizer data stream during normal
hardware-ECC transfers.
quoted hunk ↗ jump to hunk
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 51d01f7f539e8..138a141edbe4d 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -2234,6 +2462,10 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
 		ecc->strength *= 2;
 	}
 
+	/* This format requires an ECC step that fits in the page. */
+	if (sunxi_nand->randomized_oob && mtd->writesize < ecc->size)
+		return -EINVAL;
+
[Severity: High]
This isn't a bug introduced by this patch, but earlier in
sunxi_nand_hw_ecc_ctrl_init() there appears to be a divide-by-zero risk
when probing a NAND device with a 512-byte page size while the
nand-ecc-maximize device tree property is set:

	if (nanddev->ecc.user_conf.flags & NAND_ECC_MAXIMIZE_STRENGTH) {
		int bytes = mtd->oobsize;

		ecc->size = 1024;
		nsectors = mtd->writesize / ecc->size;

		...

		/*
		 * Once all user data has been subtracted, the rest can be used
		 * for ECC bytes
		 */
		bytes /= nsectors;

Since ecc->size is hardcoded to 1024, nsectors evaluates to 0 if
mtd->writesize is 512. Does this cause a division by zero kernel panic
during device probe?
 	/* Add ECC info retrieval from DT */
 	for (ecc_mode = 0; ecc_mode < nfc->caps->nstrengths; ecc_mode++) {
 		if (ecc->strength <= strengths[ecc_mode]) {
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909-submit-sunxi-nand-vendor-oob-layout-v1-v3-0-838cb0ba1547@gmail.com?part=10
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help