[PATCH 56/58] mtd: rawnand: nandsim: retain chip state across removal

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] mtd: rawnand: nandsim: shift-out-of-bounds in ns_init_module()
  [1]
--

commit c6f7998578d1a1c3b52ebeff5e9664c6e727de3e
Author: James Hilliard <james.hilliard1 at gmail.com>

mtd: rawnand: nandsim: retain chip state across removal

This commit disconnects the NAND chip before freeing simulated media and
retains the chip metadata until the final MTD reference is dropped.

> diff --git a/drivers/mtd/nand/raw/nandsim.c b/drivers/mtd/nand/raw/nandsim.c
> index fe968037f75a2..39fefd83cd850 100644
> --- a/drivers/mtd/nand/raw/nandsim.c
> +++ b/drivers/mtd/nand/raw/nandsim.c
[ ... ]
> @@ -2376,6 +2382,10 @@ static int __init ns_init_module(void)
>  	ret = ns_parse_badblocks(ns, nsmtd);
>  	if (ret)
>  		goto free_ns_object;
> +	ret = nand_set_release(chip, ns_chip_release);
> +	if (ret)
> +		goto free_ns_object;
> +	retained = true;

[Severity: High]
This problem wasn't introduced by this patch, but can setting the
overridesize module parameter to 31 or higher trigger a
shift-out-of-bounds [1] earlier in ns_init_module()?

drivers/mtd/nand/raw/nandsim.c:ns_init_module() {
	...
	if (overridesize) {
		uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
		...
		if (new_size >> overridesize != nsmtd->erasesize) {
			NS_ERR("overridesize is too big\n");
			ret = -EINVAL;
			goto cleanup_nand;
		}

		/* N.B. This relies on nand_scan not doing anything with the size before we change it */
		nsmtd->size = new_size;
		memorg->eraseblocks_per_lun = 1 << overridesize;
	...
}

Because new_size is 64-bit, the bounds check passes for overridesize
values up to 63, while "1 << overridesize" shifts a 32-bit signed int.
An overridesize of 31 or more overflows or invokes undefined behavior,
leaving eraseblocks_per_lun zero or bogus and leading to a divide-by-zero
during MTD I/O operations.

[1] https://sashiko.dev/#/bug/linux-85e29763-d721-4e3b-9253-7b65f9dada3a

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107-submit-rawnand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com?part=56