linux-toradex.git/drivers/mtd/mtdcore.c, branch v6.9-rc4

mtd: Fix possible refcounting issue when going through partition nodes

2024-02-05T12:39:33+00:00

Under normal conditions, the loop goes over all child partitions, and
'breaks' when the relevant partition is found. In this case we get a
reference to the partition node without ever releasing it. Indeed, right
after the mtd_check_of_node() function returns, we call of_node_get()
again over this very same node. It is probably safer to keep the
counters even in this helper and call of_node_put() before break-ing.

Reported-by: kernel test robot 
Reported-by: Julia Lawall 
Closes: https://lore.kernel.org/r/202312250546.ISzglvM2-lkp@intel.com/
Cc: Christian Marangi 
Cc: Rafał Miłecki 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20240104081446.126540-1-miquel.raynal@bootlin.com

mtd: Add several functions to the fail_function list

2024-01-06T22:47:07+00:00

add mtd_read(), mtd_write(), mtd_erase(), mtd_block_markbad() to
fail_function list for testing purpose

- Specify the function to inject the fault
echo mtd_read > /sys/kernel/debug/fail_function/inject

- Specifies the return value of the function to inject the fault
printf %#x -12 > /sys/kernel/debug/fail_function/mtd_read/retval

- Specify other fault injection configuration parameters.
echo -1 > /sys/kernel/debug/fail_function/times
echo 100 > /sys/kernel/debug/fail_function/probability
echo 15 > /sys/kernel/debug/fail_function/space

Signed-off-by: ZhaoLong Wang 
Reviewed-by: Zhihao Cheng 
Signed-off-by: Richard Weinberger

Merge tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2023-11-04T21:04:30+00:00

Pull mtd updates from Miquel Raynal:
 "The main set of changes is related to Uwe's work converting platform
  remove callbacks to return void. Comes next (in number of changes)
  Kees' additional structures annotations to improve the sanitizers. The
  usual amount of cleanups apply.

  About the more substancial contribution, one main function of the
  partitions core could return an error which was not checked, this is
  now fixed. On the bindings side, fixed partitions can now have a
  compression property. Finally, an erroneous situation is now always
  avoided in the MAP RAM driver.

  CFI:

   - A several years old byte swap has been fixed.

  NAND:

   - The subsystem has, as usual, seen a bit of cleanup being done this
     cycle, typically return values of platform_get_irq() and
     devm_kasprintf(). There is also a better ECC check in the Arasan
     driver. This comes with smaller misc changes.

   - In the SPI-NAND world there is now support for Foresee F35SQA002G,
     Winbond W25N and XTX XT26 chips.

  SPI NOR:

   - For SPI NOR we cleaned the flash info entries in order to have them
     slimmer and self explanatory. In order to make the entries as slim
     as possible, we introduced sane default values so that the actual
     flash entries don't need to specify them. We now use a flexible
     macro to specify the flash ID instead of the previous INFOx()
     macros that had hardcoded ID lengths.

     Instead of:

         { "w25q512nwm", INFO(0xef8020, 0, 64 * 1024, 0)
                 OTP_INFO(256, 3, 0x1000, 0x1000) },

     We now use:

         .id = SNOR_ID(0xef, 0x80, 0x20),
         .name = "w25q512nwm",
         .otp = SNOR_OTP(256, 3, 0x1000, 0x1000),

   - We also removed some flash entries: the very old Catalyst SPI
     EEPROMs that were introduced once with the SPI-NOR subsystem, and a
     Fujitsu MRAM. Both should use the at25 EEPROM driver. The latter
     even has device tree bindings for the at25 driver.

   - We made sure that the conversion didn't introduce any unwanted
     changes by comparing the .rodata segment before and after the
     conversion. The patches landed in linux-next immediately after
     v6.6-rc2, we haven't seen any regressions yet.

   - Apart of the autumn cleaning we introduced a new flash entry,
     at25ff321a, and added block protection support for mt25qu512a"

* tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (91 commits)
  mtd: cfi_cmdset_0001: Byte swap OTP info
  mtd: rawnand: meson: check return value of devm_kasprintf()
  mtd: rawnand: intel: check return value of devm_kasprintf()
  mtd: rawnand: sh_flctl: Convert to module_platform_driver()
  mtd: spi-nor: micron-st: use SFDP table for mt25qu512a
  mtd: spi-nor: micron-st: enable lock/unlock for mt25qu512a
  mtd: rawnand: Remove unused of_gpio.h inclusion
  mtd: spinand: Add support for XTX XT26xxxDxxxxx
  mtd: spinand: winbond: add support for serial NAND flash
  mtd: rawnand: cadence: Annotate struct cdns_nand_chip with __counted_by
  mtd: rawnand: Annotate struct mtk_nfc_nand_chip with __counted_by
  mtd: spinand: add support for FORESEE F35SQA002G
  mtd: rawnand: rockchip: Use struct_size()
  mtd: rawnand: arasan: Include ECC syndrome along with in-band data while checking for ECC failure
  mtd: Use device_get_match_data()
  mtd: spi-nor: nxp-spifi: Convert to platform remove callback returning void
  mtd: spi-nor: hisi-sfc: Convert to platform remove callback returning void
  mtd: maps: sun_uflash: Convert to platform remove callback returning void
  mtd: maps: sa1100-flash: Convert to platform remove callback returning void
  mtd: maps: pxa2xx-flash: Convert to platform remove callback returning void
  ...

Revert "nvmem: add new config option"

2023-10-27T11:17:54+00:00

This reverts commit 517f14d9cf3533d5ab4fded195ab6f80a92e378f.

Config option "no_of_node" is no longer needed since adding a more
explicit and targeted option "add_legacy_fixed_of_cells".

That "no_of_node" config option was needed *earlier* to help mtd's case.

DT nodes of MTD partitions (that are also NVMEM devices) may contain
subnodes. Those SHOULD NOT be treated as NVMEM fixed cells.

To prevent NVMEM core code from parsing subnodes a "no_of_node" option
was added (and set to true in mtd) to make for_each_child_of_node() in
NVMEM a no-op. That was a bit hacky because it was messing with
"of_node" pointer to achieve some side-effect.

With the introduction of "add_legacy_fixed_of_cells" config option
things got more explicit. MTD subsystem simply tells NVMEM when to look
for fixed cells and there is no need to hack "of_node" pointer anymore.

Signed-off-by: Rafał Miłecki 
Reviewed-by: Miquel Raynal 
Signed-off-by: Srinivas Kandagatla 
Link: https://lore.kernel.org/r/20231023102759.31529-1-zajec5@gmail.com
Signed-off-by: Greg Kroah-Hartman

nvmem: add explicit config option to read old syntax fixed OF cells

2023-10-21T17:19:06+00:00

Binding for fixed NVMEM cells defined directly as NVMEM device subnodes
has been deprecated. It has been replaced by the "fixed-layout" NVMEM
layout binding.

New syntax is meant to be clearer and should help avoiding imprecise
bindings.

NVMEM subsystem already supports the new binding. It should be a good
idea to limit support for old syntax to existing drivers that actually
support & use it (we can't break backward compatibility!). That way we
additionally encourage new bindings & drivers to ignore deprecated
binding.

It wasn't clear (to me) if rtc and w1 code actually uses old syntax
fixed cells. I enabled them to don't risk any breakage.

Signed-off-by: Rafał Miłecki 
[for meson-{efuse,mx-efuse}.c]
Acked-by: Martin Blumenstingl 
[for mtk-efuse.c, nvmem/core.c, nvmem-provider.h]
Reviewed-by: AngeloGioacchino Del Regno 
[MT8192, MT8195 Chromebooks]
Tested-by: AngeloGioacchino Del Regno 
[for microchip-otpc.c]
Reviewed-by: Claudiu Beznea 
[SAMA7G5-EK]
Tested-by: Claudiu Beznea 
Acked-by: Jernej Skrabec 
Signed-off-by: Srinivas Kandagatla 
Link: https://lore.kernel.org/r/20231020105545.216052-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman

mtd: Add WARN_ON_ONCE() to mtd_read() to check the return value

2023-10-16T08:50:28+00:00

If the driver cannot read all the requested data, -EBADMSG or
-EUCLEAN should never be returned.

Add a WARN_ON_ONCE() to help driver developers detect this error.

Signed-off-by: ZhaoLong Wang 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20230926065733.3240322-1-wangzhaolong1@huawei.com

mtd: Clean refcounting with MTD_PARTITIONED_MASTER

2023-08-04T07:01:56+00:00

The logic is way too convoluted, let's clean the kref_get/put section to
clarify what this block does when using CONFIG_MTD_PARTITIONED_MASTER:
- Iterate through all the parent mtd devices
- Grab a reference over them all but the master
- Only grab the master whith CONFIG_MTD_PARTITIONED_MASTER
Same logic must apply in the put path, otherwise it would be broken.

Cc: Tomas Winkler 
Cc: Alexander Usyskin 
Cc: Zhang Xiaoxu 
Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")
Signed-off-by: Miquel Raynal 
Tested-by: Alexander Usyskin 
Link: https://lore.kernel.org/linux-mtd/20230731090903.770277-1-miquel.raynal@bootlin.com

mtd: fix use-after-free in mtd release

2023-08-04T07:01:31+00:00

I case of partition device_unregister() in mtd_device_release()
calls mtd_release() which frees mtd_info structure for partition.
All code after device_unregister in mtd_device_release thus
uses already freed memory.

Move part of code to mtd_release() and restict mtd->dev cleanup
to non-partion object.
For partition object such cleanup have no sense as partition
mtd_info is removed.

Cc: Miquel Raynal 
Cc: Zhang Xiaoxu 
Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")
Reviewed-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20230731115836.542747-1-alexander.usyskin@intel.com

mtd: call external _get and _put in right order

2023-07-12T11:30:10+00:00

MTD provider provides mtd_info object to mtd subsystem.
With kref patch the mtd_info object can be alive after
provider released mtd device.
Fix calling order in _get and _put functions to allow
mtd provider to safely alloc and release mtd object.

Execute:
1) call external _get
2) get_module
3) add internal kref
in the get function and opposite order in the put one.

The _put_device callback should be the last in put
as the master struct memory may be freed in this callback.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20230620131905.648089-3-alexander.usyskin@intel.com

mtd: use refcount to prevent corruption

2023-07-12T11:30:08+00:00

When underlying device is removed mtd core will crash
in case user space is holding open handle.
Need to use proper refcounting so device is release
only when has no users.

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20230620131905.648089-2-alexander.usyskin@intel.com