[PATCH] mtd: nand: pxa3xx: Fix buffer overflow during raw reads

[Pierre Bourdon]

Chunked raw reads get accumulated to the data buffer, but in some
ECC configurations they can end up being larger than the originally
computed size (write page size + OOB size). For example:

4K page size, ECC strength 8:
- Normal reads: writesize (4096B) + oobsize (128B) = 4224 bytes.
- Chunked raw reads: 4 chunks of 1024B + 1 final spare area of 64B + 5
  ECC areas of 32B = 4320B.

Fixes: 6293b0361d9 ("mtd: nand: pxa3xx: add raw read support")
Signed-off-by: Pierre Bourdon <delroth at gmail.com>
---

 drivers/mtd/nand/raw/pxa3xx_nand.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/pxa3xx_nand.c b/drivers/mtd/nand/raw/pxa3xx_nand.c
index d502e967f9..2894ababbe 100644
--- a/drivers/mtd/nand/raw/pxa3xx_nand.c
+++ b/drivers/mtd/nand/raw/pxa3xx_nand.c
@@ -1471,6 +1471,19 @@ static void pxa3xx_nand_detect_config(struct pxa3xx_nand_info *info)
 
 static int pxa3xx_nand_init_buff(struct pxa3xx_nand_info *info)
 {
+	unsigned int chunk_size;
+	unsigned int last_chunk_size;
+
+	/*
+	 * The data buffer needs to not only be large enough for normal + OOB
+	 * reads, but also for raw reads. The raw reads can end up taking more
+	 * space due to the chunking scheme.
+	 */
+	chunk_size = info->chunk_size + info->spare_size + info->ecc_size;
+	last_chunk_size =
+		info->last_chunk_size + info->last_spare_size + info->ecc_size;
+	info->buf_size = info->nfullchunks * chunk_size + last_chunk_size;
+
 	info->data_buff = kmalloc(info->buf_size, GFP_KERNEL);
 	if (info->data_buff == NULL)
 		return -ENOMEM;
@@ -1661,7 +1674,6 @@ static int pxa3xx_nand_scan(struct mtd_info *mtd)
 	kfree(info->data_buff);
 
 	/* allocate the real data + oob buffer */
-	info->buf_size = mtd->writesize + mtd->oobsize;
 	ret = pxa3xx_nand_init_buff(info);
 	if (ret)
 		return ret;
-- 
2.41.0