[ Upstream commit ca19808bc6fac7e29420d8508df569b346b3e339 ]

In docg3_release(), the docg3 pointer is obtained from
cascade->floors[0]->priv before the loop that calls
doc_release_device() on each floor. doc_release_device() frees the
docg3 struct via kfree(docg3) at line 1881. After the loop,
docg3->cascade->bch dereferences the already-freed pointer.

Fix this by accessing cascade->bch directly, which is equivalent
since docg3->cascade points back to the same cascade struct, and
is already available as a local variable. This also removes the
now-unused docg3 local variable.

Fixes: c8ae3f744ddc ("lib/bch: Rework a little bit the exported function names")
Cc: stable@vger.kernel.org
Signed-off-by: James Kim <james010kim@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit eb0cec77d534413a800ec20944a2b1e37cfecdcf ]

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://lore.kernel.org/linux-mtd/20231008200143.196369-5-u.kleine-koenig@pengutronix.de
Stable-dep-of: ca19808bc6fa ("mtd: docg3: fix use-after-free in docg3_release()")
Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 395999829880a106bb95f0ce34e6e4c2b43c6a5d ]

devm_kasprintf() can return a NULL pointer on failure but this
returned value is not checked.

Fixes: acfe63ec1c59 ("mtd: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Charles Han <hanchunchao@inspur.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20240828092427.128177-1-hanchunchao@inspur.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 336c218dd7f0588ed8a7345f367975a00a4f003f ]

GCC 12.3.0 compiler on linux-next next-20240709 tree found the execution
path in which, due to lazy evaluation, devlength isn't initialised with the
parsed string:

   289		while (map) {
   290			devname = devstart = devlength = NULL;
   291
   292			if (!(devname = strsep(&map, ","))) {
   293				E("slram: No devicename specified.\n");
   294				break;
   295			}
   296			T("slram: devname = %s\n", devname);
   297			if ((!map) || (!(devstart = strsep(&map, ",")))) {
   298				E("slram: No devicestart specified.\n");
   299			}
   300			T("slram: devstart = %s\n", devstart);
 → 301			if ((!map) || (!(devlength = strsep(&map, ",")))) {
   302				E("slram: No devicelength / -end specified.\n");
   303			}
 → 304			T("slram: devlength = %s\n", devlength);
   305			if (parse_cmdline(devname, devstart, devlength) != 0) {
   306				return(-EINVAL);
   307			}

Parsing should be finished after map == NULL, so a break is best inserted after
each E("slram: ... \n") error message.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Vignesh Raghavendra <vigneshr@ti.com>
Cc: linux-mtd@lists.infradead.org
Signed-off-by: Mirsad Todorovac <mtodorovac69@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20240711234319.637824-1-mtodorovac69@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared
and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be
replaced by devm_clk_get_enabled() when driver enables (and possibly
prepares) the clocks for the whole lifetime of the device. Moreover, it is
no longer necessary to unprepare and disable the clocks explicitly, so drop
the label "err_irq".

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230821031737.1973183-2-lizetao1@huawei.com

The DT of_device.h and of_platform.h date back to the separate
of_platform_bus_type before it was merged into the regular platform bus.
As part of that merge prepping Arm DT support 13 years ago, they
"temporarily" include each other. They also include platform_device.h
and of.h. As a result, there's a pretty much random mix of those include
files used throughout the tree. In order to detangle these headers and
replace the implicit includes with struct declarations, users need to
explicitly include the correct includes.

Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230714174751.4060439-1-robh@kernel.org

Pointer variables of (void*) type do not require type cast.

Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230529015011.38811-1-suhui@nfschina.com

Use devm_platform_ioremap_resource() to simplify code.

Signed-off-by: Yangtao Li <frank.li@vivo.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230707040622.78174-17-frank.li@vivo.com

Use devm_platform_ioremap_resource() to simplify code.

Signed-off-by: Yangtao Li <frank.li@vivo.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230707040622.78174-16-frank.li@vivo.com

Pull mtd updates from
 "Core MTD changes:
   - otp:
      - Put factory OTP/NVRAM into the entropy pool
      - Clean up on error in mtd_otp_nvmem_add()

  MTD devices changes:
   - sm_ftl: Fix typos in comments
   - Use SPDX license headers
   - pismo: Switch back to use i2c_driver's .probe()
   - mtdpart: Drop useless LIST_HEAD
   - st_spi_fsm: Use the devm_clk_get_enabled() helper function

  DT binding changes:
   - partitions:
      - Include TP-Link SafeLoader in allowed list
      - Add missing type for "linux,rootfs"
   - Extend the nand node names filter
   - Create a file for raw NAND chip properties
   - Mark nand-ecc-placement deprecated
   - Describe nand-ecc-mode
   - Prevent NAND chip unevaluated properties in all NAND bindings with
     a NAND chip reference.
   - Qcom: Fix a property position
   - Marvell: Convert to YAML DT schema

  Raw NAND chip drivers changes:
   - Macronix: OTP access for MX30LFxG18AC
   - Add basic Sandisk manufacturer ops
   - Add support for Sandisk SDTNQGAMA

  Raw NAND controller driver changes:
   - Meson:
      - Replace integer consts with proper defines
      - Allow waiting w/o wired ready/busy pin
      - Check buffer length validity
      - Fix unaligned DMA buffers handling
      - dt-bindings: Fix 'nand-rb' property
   - Arasan: Revert "mtd: rawnand: arasan: Prevent an unsupported
     configuration" as this limitation is no longer true thanks to the
     recent efforts in improving the clocks support in this driver

  SPI-NAND changes:
   - Gigadevice: add support for GD5F2GQ5xExxH
   - Macronix: Add support for serial NAND flashes"

* tag 'mtd/for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (38 commits)
  dt-bindings: mtd: marvell-nand: Convert to YAML DT scheme
  dt-bindings: mtd: ti,am654: Prevent unevaluated properties
  dt-bindings: mtd: mediatek: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: mediatek: Reference raw-nand-chip.yaml
  dt-bindings: mtd: stm32: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: rockchip: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: intel: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: denali: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: brcmnand: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: meson: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: sunxi: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: ingenic: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: qcom: Prevent NAND chip unevaluated properties
  dt-bindings: mtd: qcom: Fix a property position
  dt-bindings: mtd: Describe nand-ecc-mode
  dt-bindings: mtd: Mark nand-ecc-placement deprecated
  dt-bindings: mtd: Create a file for raw NAND chip properties
  dt-bindings: mtd: Accept nand related node names
  mtd: sm_ftl: Fix typos in comments
  mtd: otp: clean up on error in mtd_otp_nvmem_add()
  ...