linux-toradex.git/drivers/mtd/nand, branch master

Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2026-07-17T16:30:17+00:00

Pull mtd fixes from Miquel Raynal:
 "Among the most important fixes that we have here, there are:

   - the revert of the uclinux map driver which was presumed to
     be no longer used but in fact was

   - the use of SPI match data to get chip capabilities in the
     mchp23k256 driver

   - several fixes addressing the newly introduced virt-concat
     support

   - a missing build dependency on ndfc

  as well as the usual load (if not actually bigger than usual) of
  uninitialized variables, leaks, double free, and AI fuzzed issues
  being fixed"

* tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  Revert "mtd: maps: remove uclinux map driver"
  mtd: onenand: samsung: report DMA completion timeouts
  mtd: rawnand: fsl_ifc: return errors for failed page reads
  mtd: mchp23k256: use SPI match data for chip caps
  mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
  mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
  mtd: fix double free and WARN_ON in add_mtd_device() error paths
  mtd: virt-concat: free duplicate generated name
  mtd: nand: mtk-ecc: stop on ECC idle timeouts
  mtd: mtdswap: remove debugfs stats file on teardown
  mtd: mtdpart: validate partition bounds in mtd_add_partition()
  mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path
  mtd: rawnand: ndfc: add CONFIG_OF dependency
  mtd: spinand: initialize ret in regular page reads
  mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
  mtd: rawnand: ingenic: handle ECC clock enable failures
  mtd: nand: ecc-mtk: handle ECC clock enable failures
  mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
  mtd: rawnand: ndfc: fix gcc uninitialized var

mtd: onenand: samsung: report DMA completion timeouts

2026-07-03T13:46:10+00:00

The S5PC110 OneNAND DMA helpers have bounded waits for transfer
completion. The polling helper falls out of its timeout loop and returns
success, and the IRQ helper ignores wait_for_completion_timeout().

Return -ETIMEDOUT when the DMA transfer-done bit or completion does not
arrive before the timeout so callers can treat the buffer transfer as
failed.

Fixes: e23abf4b7743 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal

mtd: rawnand: fsl_ifc: return errors for failed page reads

2026-07-03T13:46:05+00:00

fsl_ifc_run_command() logs controller timeout and other non-OPC
completion states in ctrl->nand_stat. fsl_ifc_read_page() then only
increments the ECC failure counter for non-OPC status and still returns
max_bitflips, which can be zero.

Return -ETIMEDOUT when the command did not complete at all and -EIO for
other non-OPC read completions so the NAND core does not treat a failed
page read as a clean page.

Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal

mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

2026-07-03T13:45:55+00:00

lpc32xx_xmit_dma() waits for the DMA completion callback but ignores
wait_for_completion_timeout(). A timed out DMA transfer is therefore
unmapped and reported as successful to the NAND read/write path.

Return -ETIMEDOUT when the completion wait expires. Terminate the DMA
channel before unmapping the scatterlist so the timed out transfer cannot
continue to access the buffer after the error is returned.

Fixes: 2944a44da09e ("mtd: add LPC32xx SLC NAND driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Zapolskiy 
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal

mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout

2026-07-03T13:45:49+00:00

lpc32xx_xmit_dma() starts a DMA transfer and waits up to one second
for its completion, but it ignores the wait result and returns success
after unmapping the buffer.

A timed out read can therefore return success with incomplete data, and
a timed out write can continue the NAND operation without proof that the
DMA payload reached the controller.

Terminate the DMA channel on timeout, unmap the scatterlist through the
existing cleanup path, and return -ETIMEDOUT to the NAND read/write
callers. Initialize the shared cleanup-path result before using it for
dmaengine_prep_slave_sg() failures.

Fixes: 70f7cb78ec53 ("mtd: add LPC32xx MLC NAND driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Zapolskiy 
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of  by the more specific
 where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich 
Acked-by: Takashi Sakamoto 
Acked-by: Bjorn Helgaas 
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub)

mtd: nand: mtk-ecc: stop on ECC idle timeouts

2026-06-29T14:58:00+00:00

mtk_ecc_wait_idle() logs when the encoder or decoder does not become
idle, but returns void. Callers can therefore configure a non-idle ECC
engine or read parity bytes after an unconfirmed encoder idle state.

Return the idle poll result and propagate it from the enable and encode
paths that require the engine to be idle before continuing.

Fixes: 1d6b1e464950 ("mtd: mediatek: driver for MTK Smart Device")
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal

mtd: rawnand: ndfc: add CONFIG_OF dependency

2026-06-29T14:41:21+00:00

When compile-testing on x86 without CONFIG_OF, the ndfc driver produces
a harmless warning:

drivers/mtd/nand/raw/ndfc.c: In function 'ndfc_probe':
include/linux/dev_printk.h:154:31: error: 'len' is used uninitialized [-Werror=uninitialized]
  154 |         dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
      |                               ^
drivers/mtd/nand/raw/ndfc.c:196:17: note: in expansion of macro 'dev_err'
  196 |                 dev_err(&ofdev->dev, "unable read reg property (%d)\n", len);

Limit compile-testing to configurations with CONFIG_OF to trivially
avoid this. The driver will still be built in allmodconfig and many
randconfig builds.

Fixes: 4f2692a5383e ("mtd: rawnand: ndfc: use ioread32be/iowrite32be and allow COMPILE_TEST")
Signed-off-by: Arnd Bergmann 
Reviewed-by: Rosen Penev 
Signed-off-by: Miquel Raynal

mtd: spinand: initialize ret in regular page reads

2026-06-29T14:40:36+00:00

spinand_mtd_regular_page_read() returns ret after iterating over the
requested pages. If the request contains no data or OOB bytes, the
iterator does not run and ret is not assigned. Initialize it to 0 for the
empty request path.

Signed-off-by: Ruoyu Wang 
Signed-off-by: Miquel Raynal

mtd: rawnand: ingenic: handle ECC clock enable failures

2026-06-29T14:39:14+00:00

ingenic_ecc_get() obtains a provider device reference and then enables
the ECC clock before returning the ECC handle.

The clk_prepare_enable() return value is currently ignored.  If enabling
the clock fails, the function still returns the ECC handle and keeps the
provider device reference even though the acquire operation did not
complete.

Return the clock enable error and drop the provider device reference on
that failure path.

Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal