kernel/linux.git/drivers/mtd/mtd_blkdevs.c, branch v6.1.168

mtd: Fix gluebi NULL pointer dereference caused by ftl notifier

2024-01-25T23:27:21+00:00

[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2] Signed-off-by: ZhaoLong Wang Reviewed-by: Zhihao Cheng Acked-by: Richard Weinberger Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com Signed-off-by: Sasha Levin

block: remove blk_cleanup_disk

2022-06-28T12:33:15+00:00

blk_cleanup_disk is nothing but a trivial wrapper for put_disk now, so remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20220619060552.1850436-7-hch@lst.de Signed-off-by: Jens Axboe

block: remove QUEUE_FLAG_DISCARD

2022-04-18T01:49:59+00:00

Just use a non-zero max_discard_sectors as an indicator for discard support, similar to what is done for write zeroes. The only places where needs special attention is the RAID5 driver, which must clear discard support for security reasons by default, even if the default stacking rules would allow for it. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Acked-by: Christoph Böhmwalder [drbd] Acked-by: Jan Höppner [s390] Acked-by: Coly Li [bcache] Acked-by: David Sterba [btrfs] Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20220415045258.199825-25-hch@lst.de Signed-off-by: Jens Axboe

mtd_blkdevs: avoid soft lockups with some mtd/spi devices

2022-01-26T10:43:02+00:00

With some spi devices, the heavy cpu usage due to polling the spi registers may lead to netdev timeouts, RCU complaints, etc. This can be acute in the absence of CONFIG_PREEMPT. This patch allows to give enough breathing room to avoid those incorrectly detected netdev timeouts for example. Example splat on 5.10.92: [ 828.399306] rcu: INFO: rcu_sched self-detected stall on CPU ... [ 828.419245] Task dump for CPU 1: [ 828.422465] task:kworker/1:1H state:R running task on cpu 1 stack: 0 pid: 76 ppid: 2 flags:0x0000002a [ 828.433132] Workqueue: kblockd blk_mq_run_work_fn [ 828.437820] Call trace: ... [ 828.512267] spi_mem_exec_op+0x4d0/0xde0 [ 828.516184] spi_mem_dirmap_read+0x180/0x39c [ 828.520443] spi_nor_read_data+0x428/0x7e8 [ 828.524523] spi_nor_read+0x154/0x214 [ 828.528172] mtd_read_oob+0x440/0x714 [ 828.531815] mtd_read+0xac/0x120 [ 828.535030] mtdblock_readsect+0x178/0x230 [ 828.539102] mtd_blktrans_work+0x9fc/0xf28 [ 828.543177] mtd_queue_rq+0x1ac/0x2e4 [ 828.546827] blk_mq_dispatch_rq_list+0x2cc/0xa44 [ 828.551419] blk_mq_do_dispatch_sched+0xb0/0x7cc [ 828.556010] __blk_mq_sched_dispatch_requests+0x350/0x494 [ 828.561372] blk_mq_sched_dispatch_requests+0xac/0xe4 [ 828.566387] __blk_mq_run_hw_queue+0x130/0x254 [ 828.570806] blk_mq_run_work_fn+0x50/0x60 [ 828.574814] process_one_work+0x578/0xf1c [ 828.578814] worker_thread+0x5dc/0xea0 [ 828.582547] kthread+0x270/0x2d4 [ 828.585765] ret_from_fork+0x10/0x30 Signed-off-by: David Decotigny Reviewed-by: Richard Weinberger Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220126101120.676021-1-decot+git@google.com

mtd_blkdevs: don't scan partitions for plain mtdblock

2021-12-12T19:19:10+00:00

mtdblock / mtdblock_ro set part_bits to 0 and thus nevever scanned partitions. Restore that behavior by setting the GENHD_FL_NO_PART flag. Fixes: 1ebe2e5f9d68e94c ("block: remove GENHD_FL_EXT_DEVT") Reported-by: Geert Uytterhoeven Signed-off-by: Christoph Hellwig Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20211206070409.2836165-1-hch@lst.de Signed-off-by: Jens Axboe

mtd_blkdevs: remove the sector out of range check in do_blktrans_request

2021-11-29T13:41:29+00:00

The block layer already performs this check, no need to duplicate it in the driver. Signed-off-by: Christoph Hellwig Reviewed-by: Miquel Raynal Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20211126121802.2090656-2-hch@lst.de Signed-off-by: Jens Axboe

block: remove rq_flush_dcache_pages

2021-11-29T13:34:50+00:00

This function is trivial, and flush_dcache_page is always defined, so just open code it in the 2.5 callers. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20211117061404.331732-3-hch@lst.de Signed-off-by: Jens Axboe

mtd: add add_disk() error handling

2021-10-21T15:00:56+00:00

We never checked for errors on add_disk() as this function returned void. Now that this is fixed, use the shiny new error handling. Acked-by: Miquel Raynal Signed-off-by: Luis Chamberlain Link: https://lore.kernel.org/r/20211015233028.2167651-10-mcgrof@kernel.org Signed-off-by: Jens Axboe

Merge tag 'mtd/for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2021-09-05T17:50:12+00:00

Pull MTD updates from Miquel Raynal: "MTD changes: - blkdevs: - Simplify the refcounting in blktrans_{open, release} - Simplify blktrans_getgeo - Remove blktrans_ref_mutex - Simplify blktrans_dev_get - Use lockdep_assert_held - Don't hold del_mtd_blktrans_dev in blktrans_{open, release} - ftl: - Don't cast away the type when calling add_mtd_blktrans_dev - Don't cast away the type when calling add_mtd_blktrans_dev - Use container_of() rather than cast - Fix use-after-free - Add discard support - Allow use of MTD_RAM for testing purposes - concat: - Check _read, _write callbacks existence before assignment - Judge callback existence based on the master - maps: - Maps: remove dead MTD map driver for PMC-Sierra MSP boards - mtdblock: - Warn if added for a NAND device - Add comment about UBI block devices - Update old JFFS2 mention in Kconfig - partitions: - Redboot: convert to YAML NAND core changes: - Repair Miquel Raynal's email address in MAINTAINERS - Fix a couple of spelling mistakes in Kconfig - bbt: Skip bad blocks when searching for the BBT in NAND - Remove never changed ret variable Raw NAND changes: - cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' - intel: Fix error handling in probe - omap: Fix kernel doc warning on 'calcuate' typo - gpmc: Fix the ECC bytes vs. OOB bytes equation SPI-NAND core changes: - Properly fill the OOB area. - Fix comment SPI-NAND drivers changes: - macronix: Add Quad support for serial NAND flash" * tag 'mtd/for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits) mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' mtd_blkdevs: simplify the refcounting in blktrans_{open, release} mtd_blkdevs: simplify blktrans_getgeo mtd_blkdevs: remove blktrans_ref_mutex mtd_blkdevs: simplify blktrans_dev_get mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev mtd/ftl: don't cast away the type when calling add_mtd_blktrans_dev mtd_blkdevs: use lockdep_assert_held mtd_blkdevs: don't hold del_mtd_blktrans_dev in blktrans_{open, release} mtd: rawnand: intel: Fix error handling in probe mtd: mtdconcat: Check _read, _write callbacks existence before assignment mtd: mtdconcat: Judge callback existence based on the master mtd: maps: remove dead MTD map driver for PMC-Sierra MSP boards mtd: rfd_ftl: use container_of() rather than cast mtd: rfd_ftl: fix use-after-free mtd: rfd_ftl: add discard support mtd: rfd_ftl: allow use of MTD_RAM for testing purposes mtdblock: Warn if added for a NAND device mtd: spinand: macronix: Add Quad support for serial NAND flash mtdblock: Add comment about UBI block devices ...

mtd_blkdevs: simplify the refcounting in blktrans_{open, release}

2021-08-23T08:01:16+00:00

Always grab a reference to the mtd_blktrans_dev in ->open instead of just on the first open, and do away with the additional temporary references in ->open and ->release. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-9-hch@lst.de