mtd: gpmi: fix the NULL pointer

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=885d71e5838f68d5dbee92ab952cc90ad6c1dc6b
Commit:     885d71e5838f68d5dbee92ab952cc90ad6c1dc6b
Parent:     7b3d2fb92067bcb29f0f085a9fa9fa64920a6646
Author:     Huang Shijie <b32955 at freescale.com>
AuthorDate: Tue Nov 12 12:23:08 2013 +0800
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Tue Nov 12 10:17:57 2013 -0800

    mtd: gpmi: fix the NULL pointer
    
    The imx23 board will check the fingerprint, so it will call the
    mx23_check_transcription_stamp. This function will use @chip->buffers->databuf
    as its buffer which is allocated in the nand_scan_tail().
    
    Unfortunately, the mx23_check_transcription_stamp is called before the
    nand_scan_tail(). So we will meet a NULL pointer bug:
    
    --------------------------------------------------------------------
    [    1.150000] NAND device: Manufacturer ID: 0xec, Chip ID: 0xd7 (Samsung NAND 4GiB 3,3V 8-bit), 4096MiB, page size: 4096, OOB size: 8
    [    1.160000] Unable to handle kernel NULL pointer dereference at virtual address 000005d0
    [    1.170000] pgd = c0004000
    [    1.170000] [000005d0] *pgd=00000000
    [    1.180000] Internal error: Oops: 5 [#1] ARM
    [    1.180000] Modules linked in:
    [    1.180000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0 #89
    [    1.180000] task: c7440000 ti: c743a000 task.ti: c743a000
    [    1.180000] PC is at memcmp+0x10/0x54
    [    1.180000] LR is at gpmi_nand_probe+0x42c/0x894
    [    1.180000] pc : [<c025fcb0>]    lr : [<c02f6a68>]    psr: 20000053
    [    1.180000] sp : c743be2c  ip : 600000d3  fp : ffffffff
    [    1.180000] r10: 000005d0  r9 : c02f5f08  r8 : 00000000
    [    1.180000] r7 : c75858a8  r6 : c75858a8  r5 : c7585b18  r4 : c7585800
    [    1.180000] r3 : 000005d0  r2 : 00000004  r1 : c05c33e4  r0 : 000005d0
    [    1.180000] Flags: nzCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
    [    1.180000] Control: 0005317f  Table: 40004000  DAC: 00000017
    [    1.180000] Process swapper (pid: 1, stack limit = 0xc743a1c0)
    --------------------------------------------------------------------
    
    This patch rearrange the init procedure:
       Set the NAND_SKIP_BBTSCAN to skip the nand scan firstly, and after we
       set the proper settings, we will call the chip->scan_bbt() manually.
    
    Cc: stable at vger.kernel.org # 3.12
    Signed-off-by: Huang Shijie <b32955 at freescale.com>
    Reported-by: Fabio Estevam <festevam at gmail.com>
    Tested-by: Fabio Estevam <fabio.estevam at freescale.com>
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
---
 drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index c7243dc..dabbc14 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -1578,8 +1578,6 @@ static int gpmi_set_geometry(struct gpmi_nand_data *this)
 
 static int gpmi_pre_bbt_scan(struct gpmi_nand_data  *this)
 {
-	int ret;
-
 	/* Set up swap_block_mark, must be set before the gpmi_set_geometry() */
 	if (GPMI_IS_MX23(this))
 		this->swap_block_mark = false;
@@ -1587,12 +1585,8 @@ static int gpmi_pre_bbt_scan(struct gpmi_nand_data  *this)
 		this->swap_block_mark = true;
 
 	/* Set up the medium geometry */
-	ret = gpmi_set_geometry(this);
-	if (ret)
-		return ret;
+	return gpmi_set_geometry(this);
 
-	/* NAND boot init, depends on the gpmi_set_geometry(). */
-	return nand_boot_init(this);
 }
 
 static void gpmi_nfc_exit(struct gpmi_nand_data *this)
@@ -1682,10 +1676,16 @@ static int gpmi_nfc_init(struct gpmi_nand_data *this)
 	if (ret)
 		goto err_out;
 
+	chip->options |= NAND_SKIP_BBTSCAN;
 	ret = nand_scan_tail(mtd);
 	if (ret)
 		goto err_out;
 
+	ret = nand_boot_init(this);
+	if (ret)
+		goto err_out;
+	chip->scan_bbt(mtd);
+
 	ppdata.of_node = this->pdev->dev.of_node;
 	ret = mtd_device_parse_register(mtd, NULL, &ppdata, NULL, 0);
 	if (ret)