[PATCH v2 0/2] mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB

[Miquel Raynal]

On 28/08/2026 at 10:53:35 +02, Mehmet Fide <mehmet.fide at gmail.com> wrote:

> From: Mehmet Fide <mehmet.fide at screeningeagle.com>

Sashiko says:

> New issues:
> - [High] Kernel heap memory is leaked to userspace during out-of-band
> (OOB) reads when the NAND chip's OOB size is larger than 64 bytes.

Probably right, to be checked.

> - [Medium] Integer underflows occur in OOB layout functions when the
> flash chip's spare size is smaller than the required ECC bytes + 2,
> leading to an inflated `mtd->oobavail` and potential heap buffer
> overflow.

Cannot happen.

> Pre-existing issues:
> - [High] `vf610_nfc_write_page()` completely ignores the `oob_required`
> parameter and fails to copy the caller's OOB data into the controller's
> SRAM, leading to stale data written to the flash.

Probably true.

Cheers,
Miquèl