Hi Pierre, On Sun, Jul 30, 2023 at 6:08 AM Pierre Bourdon <delr...@gmail.com> wrote: > > Chunked raw reads get accumulated to the data buffer, but in some > ECC configurations they can end up being larger than the originally > computed size (write page size + OOB size). For example: > > 4K page size, ECC strength 8: > - Normal reads: writesize (4096B) + oobsize (128B) = 4224 bytes. > - Chunked raw reads: 4 chunks of 1024B + 1 final spare area of 64B + 5 > ECC areas of 32B = 4320B.
I'm not a NAND expert and I haven't sat down and fully grasped the math but I was curious to see what the Linux kernel did. It looks like it uses the same mtd->writesize + mtd->oobsize calculation (see nand_scan_tail() in nand_base.c). So either Linux has the same bug or maybe there's something off in u-boot's nfc_layouts[]. I'll see if I can get one of my boards to trigger a KASAN report (I'm not sure if any of the NAND chips we use will hit the cases you're pointing out). > > Fixes: 6293b0361d9 ("mtd: nand: pxa3xx: add raw read support") > Signed-off-by: Pierre Bourdon <delr...@gmail.com> > --- > > drivers/mtd/nand/raw/pxa3xx_nand.c | 14 +++++++++++++- > 1 file changed, 13 insertions(+), 1 deletion(-) > > diff --git a/drivers/mtd/nand/raw/pxa3xx_nand.c > b/drivers/mtd/nand/raw/pxa3xx_nand.c > index d502e967f9..2894ababbe 100644 > --- a/drivers/mtd/nand/raw/pxa3xx_nand.c > +++ b/drivers/mtd/nand/raw/pxa3xx_nand.c > @@ -1471,6 +1471,19 @@ static void pxa3xx_nand_detect_config(struct > pxa3xx_nand_info *info) > > static int pxa3xx_nand_init_buff(struct pxa3xx_nand_info *info) > { > + unsigned int chunk_size; > + unsigned int last_chunk_size; > + > + /* > + * The data buffer needs to not only be large enough for normal + OOB > + * reads, but also for raw reads. The raw reads can end up taking more > + * space due to the chunking scheme. > + */ > + chunk_size = info->chunk_size + info->spare_size + info->ecc_size; > + last_chunk_size = > + info->last_chunk_size + info->last_spare_size + > info->ecc_size; > + info->buf_size = info->nfullchunks * chunk_size + last_chunk_size; > + > info->data_buff = kmalloc(info->buf_size, GFP_KERNEL); > if (info->data_buff == NULL) > return -ENOMEM; > @@ -1661,7 +1674,6 @@ static int pxa3xx_nand_scan(struct mtd_info *mtd) > kfree(info->data_buff); > > /* allocate the real data + oob buffer */ > - info->buf_size = mtd->writesize + mtd->oobsize; > ret = pxa3xx_nand_init_buff(info); > if (ret) > return ret; > -- > 2.41.0 >