kernel/linux.git/drivers/mtd/devices, branch v4.4.235

mtd: phram: fix a double free issue in error path

2020-04-24T05:57:26+00:00

commit 49c64df880570034308e4a9a49c4bc95cf8cdb33 upstream. The variable 'name' is released multiple times in the error path, which may cause double free issues. This problem is avoided by adding a goto label to release the memory uniformly. And this change also makes the code a bit more cleaner. Fixes: 4f678a58d335 ("mtd: fix memory leaks in phram_setup") Signed-off-by: Wen Yang Cc: Joern Engel Cc: Miquel Raynal Cc: Richard Weinberger Cc: Vignesh Raghavendra Cc: linux-mtd@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20200318153156.25612-1-wenyang@linux.alibaba.com Signed-off-by: Greg Kroah-Hartman

mtd: spear_smi: Fix Write Burst mode

2019-12-21T09:35:17+00:00

commit 69c7f4618c16b4678f8a4949b6bb5ace259c0033 upstream. Any write with either dd or flashcp to a device driven by the spear_smi.c driver will pass through the spear_smi_cpy_toio() function. This function will get called for chunks of up to 256 bytes. If the amount of data is smaller, we may have a problem if the data length is not 4-byte aligned. In this situation, the kernel panics during the memcpy: # dd if=/dev/urandom bs=1001 count=1 of=/dev/mtd6 spear_smi_cpy_toio [620] dest c9070000, src c7be8800, len 256 spear_smi_cpy_toio [620] dest c9070100, src c7be8900, len 256 spear_smi_cpy_toio [620] dest c9070200, src c7be8a00, len 256 spear_smi_cpy_toio [620] dest c9070300, src c7be8b00, len 233 Unhandled fault: external abort on non-linefetch (0x808) at 0xc90703e8 [...] PC is at memcpy+0xcc/0x330 The above error occurs because the implementation of memcpy_toio() tries to optimize the number of I/O by writing 4 bytes at a time as much as possible, until there are less than 4 bytes left and then switches to word or byte writes. Unfortunately, the specification states about the Write Burst mode: "the next AHB Write request should point to the next incremented address and should have the same size (byte, half-word or word)" This means ARM architecture implementation of memcpy_toio() cannot reliably be used blindly here. Workaround this situation by update the write path to stick to byte access when the burst length is not multiple of 4. Fixes: f18dbbb1bfe0 ("mtd: ST SPEAr: Add SMI driver for serial NOR flash") Cc: Russell King Cc: Boris Brezillon Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Russell King Signed-off-by: Greg Kroah-Hartman

mtd: docg3: don't set conflicting BCH_CONST_PARAMS option

2018-11-21T08:27:42+00:00

commit be2e1c9dcf76886a83fb1c433a316e26d4ca2550 upstream. I noticed during the creation of another bugfix that the BCH_CONST_PARAMS option that is set by DOCG3 breaks setting variable parameters for any other users of the BCH library code. The only other user we have today is the MTD_NAND software BCH implementation (most flash controllers use hardware BCH these days and are not affected). I considered removing BCH_CONST_PARAMS entirely because of the inherent conflict, but according to the description in lib/bch.c there is a significant performance benefit in keeping it. To avoid the immediate problem of the conflict between MTD_NAND_BCH and DOCG3, this only sets the constant parameters if MTD_NAND_BCH is disabled, which should fix the problem for all cases that are affected. This should also work for all stable kernels. Note that there is only one machine that actually seems to use the DOCG3 driver (arch/arm/mach-pxa/mioa701.c), so most users should have the driver disabled, but it almost certainly shows up if we wanted to test random kernels on machines that use software BCH in MTD. Fixes: d13d19ece39f ("mtd: docg3: add ECC correction code") Cc: stable@vger.kernel.org Cc: Robert Jarzmik Signed-off-by: Arnd Bergmann Signed-off-by: Boris Brezillon Signed-off-by: Greg Kroah-Hartman

Merge tag 'for-linus-20151106' of git://git.infradead.org/linux-mtd

2015-11-06T19:50:24+00:00

Pull MTD updates from Brian Norris: "Core: - WARN (in some cases) when a struct mtd_info is registered multiple times; in the past this was "supported", but it's still error prone for future development. There's only one ugly case of this left in the tree (that we're aware of) and the owners are aware of the problems there. - fix potential deadlock in the blkdev removal path NOTE: the (potential) deadlock was introduced in a for-stable patch. This one is also marked for -stable. - ioctl(BLKPG) compat_ioctl support; resolves issues with 32-bit user space vs 64-bit kernel space - Set MTD parent device correctly throughout the tree, so the tree structure appears correctly in sysfs; many drivers were missing this (soft) requirement - Move device tree partitions (ofpart) into a dedicated 'partitions' subnode; this helps to disambiguate whether a node is a partition or some other auxiliary data - Improve error handling for partitioning failures NAND: - General: Increase timeout period, for corner-case systems with less-than-accurate jiffies - Fix OF-based autoloading of several NAND drivers when built as modules - pxa3xx_nand: - Rework timing configuration to be more dynamic - Refactor PM support - brcmnand: prepare for NorthStar 2 support (ARM64, 16-bit NAND chips) - sunxi_nand: refactoring and a few bug fixes - vf610: new NAND driver - FSMC: add SW BCH support; support common NAND DT bindings - lpc32xx_slc: refactor and improve timing calculations logic - denali: support for rev 5.1 SPI NOR: - Layering improvements - Added Winbond lock/unlock support - Added mtd_is_locked() (i.e., ioctl(MEMISLOCKED)) support - Increase full-chip-erase timeout linearly with flash size - fsl-quadspi: fix compile for non-ARM architectures - New flash support" * tag 'for-linus-20151106' of git://git.infradead.org/linux-mtd: (169 commits) mtd: don't WARN about overloaded users of mtd->reboot_notifier.notifier_call mtd: nand: sunxi: avoid retrieving data before ECC pass mtd: nand: sunxi: fix sunxi_nfc_hw_ecc_read/write_chunk() mtd: blkdevs: fix potential deadlock + lockdep warnings mtd: ofpart: move ofpart partitions to a dedicated dt node doc: dt: mtd: support partitions in a special 'partitions' subnode mtd: brcmnand: Force 8bit mode before doing nand_scan_ident() mtd: brcmnand: factor out CFG and CFG_EXT bitfields mtd: mtdpart: Do not fail mtd probe when parsing partitions fails mtd: fsl-quadspi: fix macro collision problems with READ/WRITE mtd: warn when registering the same master many times mtd: fixup corner case error handling in mtd_device_parse_register() mtd: tests: Replace timeval with ktime_t mtd: fsmc_nand: Add BCH4 SW ECC support for SPEAr600 mtd: nand: vf610_nfc: use nand_check_erased_ecc_chunk() helper mtd: nand: increase ready wait timeout and report timeouts mtd: docg3: off by one in doc_register_sysfs() mtd: pxa3xx_nand: clean up the pxa3xx timings mtd: pxa3xx_nand: rework flash detection and timing setup mtd: pxa3xx_nand: add helpers to setup the timings ...

spi: Drop owner assignment from spi_drivers

2015-10-28T01:30:17+00:00

An spi_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Andrew F. Davis Acked-by: Jonathan Cameron Signed-off-by: Mark Brown

mtd: docg3: off by one in doc_register_sysfs()

2015-10-26T18:45:30+00:00

Smatch found a bug in the error handling: drivers/mtd/devices/docg3.c:1634 doc_register_sysfs() error: buffer overflow 'doc_sys_attrs' 4 <= 4 The problem is that if the very last device_create_file() fails, then we are beyond the end of the array. Actually, any time i == 3 then there is a problem. We can fix this an simplify the code at the same time by moving the !ret conditions out of the for loops and using a goto instead. Signed-off-by: Dan Carpenter Acked-by: Robert Jarzmik Signed-off-by: Brian Norris

mtd: mtdram: check offs and len in mtdram->erase

2015-10-20T01:08:33+00:00

We should prevent user to erasing mtd device with an unaligned offset or length. Signed-off-by: Dongsheng Yang Signed-off-by: Brian Norris

mtd: devices: sst251: show parent device in sysfs

2015-10-13T16:21:16+00:00

Fix a bug where mtd parent device symlinks aren't shown in sysfs. While at it, make use of the default owner value set by mtdcore. Signed-off-by: Frans Klaver Signed-off-by: Brian Norris

mtd: devices: spear_smi: show parent device in sysfs

2015-10-13T16:21:15+00:00

Fix a bug where mtd parent device symlinks aren't shown in sysfs. Signed-off-by: Frans Klaver Signed-off-by: Brian Norris

mtd: devices: mtd_dataflash: drop owner assignment

2015-10-13T16:21:15+00:00

Owner is automatically set by mtdcore. Make use of that. Signed-off-by: Frans Klaver Signed-off-by: Brian Norris