diff options
| author | Mark Brown <broonie@kernel.org> | 2025-06-30 12:42:36 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2025-06-30 12:42:36 +0100 |
| commit | 4ec24e9601d5cfc9ac9798c0acb8e88c6ab61fc5 (patch) | |
| tree | 356d3a2c38c739da3a0347a57db7bf90b6e57e8d /drivers/spi | |
| parent | fa60c094c19b97e103d653f528f8d9c178b6a5f5 (diff) | |
| parent | ddaad4ad774d4ae02047ef873a8e38f62a4b7b01 (diff) | |
spi: spi-qpic-snand: avoid memory corruption
Merge series from Gabor Juhos <j4g8y7@gmail.com>:
The 'spi-qpic-nand' driver may cause memory corruption under some
circumstances. The first patch in the series changes the driver to
avoid that, whereas the second adds some sanity checks to the common
QPIC code in order to make detecting such errors easier in the future.
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi-qpic-snand.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c index 77d9cc65477a..f2e1a27b410d 100644 --- a/drivers/spi/spi-qpic-snand.c +++ b/drivers/spi/spi-qpic-snand.c @@ -315,6 +315,22 @@ static int qcom_spi_ecc_init_ctx_pipelined(struct nand_device *nand) mtd_set_ooblayout(mtd, &qcom_spi_ooblayout); + /* + * Free the temporary BAM transaction allocated initially by + * qcom_nandc_alloc(), and allocate a new one based on the + * updated max_cwperpage value. + */ + qcom_free_bam_transaction(snandc); + + snandc->max_cwperpage = cwperpage; + + snandc->bam_txn = qcom_alloc_bam_transaction(snandc); + if (!snandc->bam_txn) { + dev_err(snandc->dev, "failed to allocate BAM transaction\n"); + ret = -ENOMEM; + goto err_free_ecc_cfg; + } + ecc_cfg->cfg0 = FIELD_PREP(CW_PER_PAGE_MASK, (cwperpage - 1)) | FIELD_PREP(UD_SIZE_BYTES_MASK, ecc_cfg->cw_data) | FIELD_PREP(DISABLE_STATUS_AFTER_WRITE, 1) | |