MTD: Fatal regression in drivers/mtd/redboot.c in 2.6.20

[MTD] Fix regression in RedBoot partition scanning

This fixes a regression introduced by the attempt to handle RedBoot FIS
tables which are smaller than an eraseblock, in commit
0b47d654089c5ce3f2ea26a4485db9bcead1e515

It moves the recalculation of the number of slots in the table to the
correct place, and improves the heuristic for when we think we need to
byte-swap what we read from the flash.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Cc: Rod Whitby <rod@whitby.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c
index 035cd9b0cc08b327f83d8f12958eacdcab7f6c94..a61351f88ec046d894bf07bc042907e2a22bb364 100644 (file)
--- a/drivers/mtd/redboot.c
+++ b/drivers/mtd/redboot.c
@@ -94,8 +94,19 @@ static int parse_redboot_partitions(struct mtd_info *master,
                         * (NOTE: this is 'size' not 'data_length'; size is
                         * the full size of the entry.)
                         */
-                       if (swab32(buf[i].size) == master->erasesize) {
+
+                       /* RedBoot can combine the FIS directory and
+                          config partitions into a single eraseblock;
+                          we assume wrong-endian if either the swapped
+                          'size' matches the eraseblock size precisely,
+                          or if the swapped size actually fits in an
+                          eraseblock while the unswapped size doesn't. */
+                       if (swab32(buf[i].size) == master->erasesize ||
+                           (buf[i].size > master->erasesize
+                            && swab32(buf[i].size) < master->erasesize)) {
                                int j;
+                               /* Update numslots based on actual FIS directory size */
+                               numslots = swab32(buf[i].size) / sizeof (struct fis_image_desc);
                                for (j = 0; j < numslots; ++j) {
 
                                        /* A single 0xff denotes a deleted entry.
@@ -120,11 +131,11 @@ static int parse_redboot_partitions(struct mtd_info *master,
                                        swab32s(&buf[j].desc_cksum);
                                        swab32s(&buf[j].file_cksum);
                                }
+                       } else if (buf[i].size < master->erasesize) {
+                               /* Update numslots based on actual FIS directory size */
+                               numslots = buf[i].size / sizeof(struct fis_image_desc);
                        }
                        break;
-               } else {
-                       /* re-calculate of real numslots */
-                       numslots = buf[i].size / sizeof(struct fis_image_desc);
                }
        }
        if (i == numslots) {