linux-stable.git/drivers/mtd/mtdcore.c, branch linux-6.0.y

mtd: core: Fix refcount error in del_mtd_device()

2022-12-31T12:26:02+00:00

[ Upstream commit 56570bdad5e31c5c538cd6efff5c4510256e1bb4 ]

del_mtd_device() will call of_node_put() to mtd_get_of_node(mtd), which
is mtd->dev.of_node. However, memset(&mtd->dev, 0) is called before
of_node_put(). As the result, of_node_put() won't do anything in
del_mtd_device(), and causes the refcount leak.

del_mtd_device()
    memset(&mtd->dev, 0, sizeof(mtd->dev) # clear mtd->dev
    of_node_put()
        mtd_get_of_node(mtd) # mtd->dev is cleared, can't locate of_node
                             # of_node_put(NULL) won't do anything

Fix the error by caching the pointer of the device_node.

OF: ERROR: memory leak, expected refcount 1 instead of 2,
of_node_get()/of_node_put() unbalanced - destroy cset entry: attach
overlay node /spi/spi-sram@0
CPU: 3 PID: 275 Comm: python3 Tainted: G N 6.1.0-rc3+ #54
    0d8a1edddf51f172ff5226989a7565c6313b08e2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
Call Trace:

    dump_stack_lvl+0x67/0x83
    kobject_get+0x155/0x160
    of_node_get+0x1f/0x30
    of_fwnode_get+0x43/0x70
    fwnode_handle_get+0x54/0x80
    fwnode_get_nth_parent+0xc9/0xe0
    fwnode_full_name_string+0x3f/0xa0
    device_node_string+0x30f/0x750
    pointer+0x598/0x7a0
    vsnprintf+0x62d/0x9b0
    ...
    cfs_overlay_release+0x30/0x90
    config_item_release+0xbe/0x1a0
    config_item_put+0x5e/0x80
    configfs_rmdir+0x3bd/0x540
    vfs_rmdir+0x18c/0x320
    do_rmdir+0x198/0x330
    __x64_sys_rmdir+0x2c/0x40
    do_syscall_64+0x37/0x90
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: 00596576a051 ("mtd: core: clear out unregistered devices a bit more")
Signed-off-by: Shang XiaoJing 
[: Light reword of the commit log]
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20221119063915.11108-1-shangxiaojing@huawei.com
Signed-off-by: Sasha Levin

mtd: core: fix possible resource leak in init_mtd()

2022-12-31T12:25:55+00:00

[ Upstream commit 1aadf01e5076b9ab6bf294b9622335c651314895 ]

I got the error report while inject fault in init_mtd():

sysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0'
Call Trace:
 
 dump_stack_lvl+0x67/0x83
 sysfs_warn_dup+0x60/0x70
 sysfs_create_dir_ns+0x109/0x120
 kobject_add_internal+0xce/0x2f0
 kobject_add+0x98/0x110
 device_add+0x179/0xc00
 device_create_groups_vargs+0xf4/0x100
 device_create+0x7b/0xb0
 bdi_register_va.part.13+0x58/0x2d0
 bdi_register+0x9b/0xb0
 init_mtd+0x62/0x171 [mtd]
 do_one_initcall+0x6c/0x3c0
 do_init_module+0x58/0x222
 load_module+0x268e/0x27d0
 __do_sys_finit_module+0xd5/0x140
 do_syscall_64+0x37/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 
kobject_add_internal failed for mtd-0 with -EEXIST, don't try to register
	things with the same name in the same directory.
Error registering mtd class or bdi: -17

If init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered,
as a result, we can't load the mtd module again, to fix this by calling
bdi_unregister(mtd_bdi) after out_procfs label.

Fixes: 445caaa20c4d ("mtd: Allocate bdi objects dynamically")
Signed-off-by: Gaosheng Cui 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20221024065109.2050705-1-cuigaosheng1@huawei.com
Signed-off-by: Sasha Levin

mtd: Fix device name leak when register device failed in add_mtd_device()

2022-12-31T12:25:55+00:00

[ Upstream commit 895d68a39481a75c680aa421546931fb11942fa6 ]

There is a kmemleak when register device failed:
  unreferenced object 0xffff888101aab550 (size 8):
    comm "insmod", pid 3922, jiffies 4295277753 (age 925.408s)
    hex dump (first 8 bytes):
      6d 74 64 30 00 88 ff ff                          mtd0....
    backtrace:
      [<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150
      [<000000003c32b416>] kvasprintf+0xb0/0x130
      [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0
      [<000000006e781163>] dev_set_name+0xab/0xe0
      [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700
      [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0
      [<00000000c0d88488>] 0xffffffffa0238457
      [<00000000b40d0922>] 0xffffffffa02a008f
      [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0
      [<00000000770f6ca6>] do_init_module+0xdf/0x320
      [<000000007b6768fe>] load_module+0x2f98/0x3330
      [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0
      [<00000000674c2290>] do_syscall_64+0x35/0x80
      [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

If register device failed, should call put_device() to give up the
reference.

Fixes: 1f24b5a8ecbb ("[MTD] driver model updates")
Signed-off-by: Zhang Xiaoxu 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20221022121352.2534682-1-zhangxiaoxu5@huawei.com
Signed-off-by: Sasha Levin

mtd: core: add missing of_node_get() in dynamic partitions code

2022-11-03T15:00:27+00:00

[ Upstream commit 12b58961de0bd88b3c7dfa5d21f6d67f4678b780 ]

This fixes unbalanced of_node_put():
[    1.078910] 6 cmdlinepart partitions found on MTD device gpmi-nand
[    1.085116] Creating 6 MTD partitions on "gpmi-nand":
[    1.090181] 0x000000000000-0x000008000000 : "nandboot"
[    1.096952] 0x000008000000-0x000009000000 : "nandfit"
[    1.103547] 0x000009000000-0x00000b000000 : "nandkernel"
[    1.110317] 0x00000b000000-0x00000c000000 : "nanddtb"
[    1.115525] ------------[ cut here ]------------
[    1.120141] refcount_t: addition on 0; use-after-free.
[    1.125328] WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xdc/0x148
[    1.133528] Modules linked in:
[    1.136589] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc7-next-20220930-04543-g8cf3f7
[    1.146342] Hardware name: Freescale i.MX8DXL DDR3L EVK (DT)
[    1.151999] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    1.158965] pc : refcount_warn_saturate+0xdc/0x148
[    1.163760] lr : refcount_warn_saturate+0xdc/0x148
[    1.168556] sp : ffff800009ddb080
[    1.171866] x29: ffff800009ddb080 x28: ffff800009ddb35a x27: 0000000000000002
[    1.179015] x26: ffff8000098b06ad x25: ffffffffffffffff x24: ffff0a00ffffff05
[    1.186165] x23: ffff00001fdf6470 x22: ffff800009ddb367 x21: 0000000000000000
[    1.193314] x20: ffff00001fdfebe8 x19: ffff00001fdfec50 x18: ffffffffffffffff
[    1.200464] x17: 0000000000000000 x16: 0000000000000118 x15: 0000000000000004
[    1.207614] x14: 0000000000000fff x13: ffff800009bca248 x12: 0000000000000003
[    1.214764] x11: 00000000ffffefff x10: c0000000ffffefff x9 : 4762cb2ccb52de00
[    1.221914] x8 : 4762cb2ccb52de00 x7 : 205d313431303231 x6 : 312e31202020205b
[    1.229063] x5 : ffff800009d55c1f x4 : 0000000000000001 x3 : 0000000000000000
[    1.236213] x2 : 0000000000000000 x1 : ffff800009954be6 x0 : 000000000000002a
[    1.243365] Call trace:
[    1.245806]  refcount_warn_saturate+0xdc/0x148
[    1.250253]  kobject_get+0x98/0x9c
[    1.253658]  of_node_get+0x20/0x34
[    1.257072]  of_fwnode_get+0x3c/0x54
[    1.260652]  fwnode_get_nth_parent+0xd8/0xf4
[    1.264926]  fwnode_full_name_string+0x3c/0xb4
[    1.269373]  device_node_string+0x498/0x5b4
[    1.273561]  pointer+0x41c/0x5d0
[    1.276793]  vsnprintf+0x4d8/0x694
[    1.280198]  vprintk_store+0x164/0x528
[    1.283951]  vprintk_emit+0x98/0x164
[    1.287530]  vprintk_default+0x44/0x6c
[    1.291284]  vprintk+0xf0/0x134
[    1.294428]  _printk+0x54/0x7c
[    1.297486]  of_node_release+0xe8/0x128
[    1.301326]  kobject_put+0x98/0xfc
[    1.304732]  of_node_put+0x1c/0x28
[    1.308137]  add_mtd_device+0x484/0x6d4
[    1.311977]  add_mtd_partitions+0xf0/0x1d0
[    1.316078]  parse_mtd_partitions+0x45c/0x518
[    1.320439]  mtd_device_parse_register+0xb0/0x274
[    1.325147]  gpmi_nand_probe+0x51c/0x650
[    1.329074]  platform_probe+0xa8/0xd0
[    1.332740]  really_probe+0x130/0x334
[    1.336406]  __driver_probe_device+0xb4/0xe0
[    1.340681]  driver_probe_device+0x3c/0x1f8
[    1.344869]  __driver_attach+0xdc/0x1a4
[    1.348708]  bus_for_each_dev+0x80/0xcc
[    1.352548]  driver_attach+0x24/0x30
[    1.356127]  bus_add_driver+0x108/0x1f4
[    1.359967]  driver_register+0x78/0x114
[    1.363807]  __platform_driver_register+0x24/0x30
[    1.368515]  gpmi_nand_driver_init+0x1c/0x28
[    1.372798]  do_one_initcall+0xbc/0x238
[    1.376638]  do_initcall_level+0x94/0xb4
[    1.380565]  do_initcalls+0x54/0x94
[    1.384058]  do_basic_setup+0x1c/0x28
[    1.387724]  kernel_init_freeable+0x110/0x188
[    1.392084]  kernel_init+0x20/0x1a0
[    1.395578]  ret_from_fork+0x10/0x20
[    1.399157] ---[ end trace 0000000000000000 ]---
[    1.403782] ------------[ cut here ]------------

Reported-by: Han Xu 
Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
Signed-off-by: Rafał Miłecki 
Tested-by: Han Xu 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20221018051822.28685-1-zajec5@gmail.com
Signed-off-by: Sasha Levin

mtd: core: check partition before dereference

2022-08-01T19:33:11+00:00

syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1],
for mtdram test device (CONFIG_MTD_MTDRAM) is not partition.

Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1]
Reported-by: syzbot 
Reported-by: kernel test robot 
Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
Signed-off-by: Tetsuo Handa 
CC: stable@vger.kernel.org
Signed-off-by: Richard Weinberger

mtd: core: introduce of support for dynamic partitions

2022-06-29T11:36:17+00:00

We have many parser that register mtd partitions at runtime. One example
is the cmdlinepart or the smem-part parser where the compatible is defined
in the dts and the partitions gets detected and registered by the
parser. This is problematic for the NVMEM subsystem that requires an OF
node to detect NVMEM cells.

To fix this problem, introduce an additional logic that will try to
assign an OF node to the MTD if declared.

On MTD addition, it will be checked if the MTD has an OF node and if
not declared will check if a partition with the same label / node name is
declared in DTS. If an exact match is found, the partition dynamically
allocated by the parser will have a connected OF node.

The NVMEM subsystem will detect the OF node and register any NVMEM cells
declared statically in the DTS.

Signed-off-by: Christian Marangi 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20220622010628.30414-4-ansuelsmth@gmail.com

mtd: core: Check devicetree alias for index

2022-04-25T08:37:49+00:00

Allow the MTD index to be specified via a devicetree alias, so that the
number does not just depend on probe order.  This is useful to allow
pseudo-devices like phram to be optionally used on systems, without
having this affect the numbering of the real hardware MTD devices.

Signed-off-by: Vincent Whitchurch 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20220412135302.1682890-2-vincent.whitchurch@axis.com

Merge tag 'char-misc-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2022-03-28T19:27:35+00:00

Pull char/misc and other driver updates from Greg KH:
 "Here is the big set of char/misc and other small driver subsystem
  updates for 5.18-rc1.

  Included in here are merges from driver subsystems which contain:

   - iio driver updates and new drivers

   - fsi driver updates

   - fpga driver updates

   - habanalabs driver updates and support for new hardware

   - soundwire driver updates and new drivers

   - phy driver updates and new drivers

   - coresight driver updates

   - icc driver updates

  Individual changes include:

   - mei driver updates

   - interconnect driver updates

   - new PECI driver subsystem added

   - vmci driver updates

   - lots of tiny misc/char driver updates

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'char-misc-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (556 commits)
  firmware: google: Properly state IOMEM dependency
  kgdbts: fix return value of __setup handler
  firmware: sysfb: fix platform-device leak in error path
  firmware: stratix10-svc: add missing callback parameter on RSU
  arm64: dts: qcom: add non-secure domain property to fastrpc nodes
  misc: fastrpc: Add dma handle implementation
  misc: fastrpc: Add fdlist implementation
  misc: fastrpc: Add helper function to get list and page
  misc: fastrpc: Add support to secure memory map
  dt-bindings: misc: add fastrpc domain vmid property
  misc: fastrpc: check before loading process to the DSP
  misc: fastrpc: add secure domain support
  dt-bindings: misc: add property to support non-secure DSP
  misc: fastrpc: Add support to get DSP capabilities
  misc: fastrpc: add support for FASTRPC_IOCTL_MEM_MAP/UNMAP
  misc: fastrpc: separate fastrpc device from channel context
  dt-bindings: nvmem: brcm,nvram: add basic NVMEM cells
  dt-bindings: nvmem: make "reg" property optional
  nvmem: brcm_nvram: parse NVRAM content into NVMEM cells
  nvmem: dt-bindings: Fix the error of dt-bindings check
  ...

Merge tag 'mtd/changes-for-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2022-03-25T20:35:34+00:00

Pull MTD updates from Miquel Raynal:
 "There has been a lot of activity in the MTD subsystem recently, with a
  number of SPI-NOR cleanups as well as the introduction of ECC engines
  that can be used by SPI controllers (hence a few SPI patches in here).

  Core MTD changes:
   - Replace the expert mode symbols with a single helper
   - Fix misuses of of_match_ptr()
   - Remove partid and partname debugfs files
   - tests: Fix eraseblock read speed miscalculation for lower partition
     sizes
   - TRX parser: Allow to use on MediaTek MIPS SoCs

  MTD driver changes:
   - spear_smi: use GFP_KERNEL
   - mchp48l640: Add SPI ID table
   - mchp23k256: Add SPI ID table
   - blkdevs: Avoid soft lockups with some mtd/spi devices
   - aspeed-smc: Improve probe resilience

  Hyperbus changes:
   - HBMC_AM654 should depend on ARCH_K3

  NAND core changes:
   - ECC:
      - Add infrastructure to support hardware engines
      - Add a new helper to retrieve the ECC context
      - Provide a helper to retrieve a pilelined engine device

  NAND-ECC changes:
   - Macronix ECC engine:
      - Add Macronix external ECC engine support
      - Support SPI pipelined mode
      - Make two read-only arrays static const
      - Fix compile test issue

  Raw NAND core changes:
   - Fix misuses of of_match_node()
   - Rework of_get_nand_bus_width()
   - Remove of_get_nand_on_flash_bbt() wrapper
   - Protect access to rawnand devices while in suspend
   - bindings: Document the wp-gpios property

  Rax NAND controller driver changes:
   - atmel: Fix refcount issue in atmel_nand_controller_init
   - nandsim:
      - Add NS_PAGE_BYTE_SHIFT macro to replace the repeat pattern
      - Merge repeat codes in ns_switch_state
      - Replace overflow check with kzalloc to single kcalloc
   - rockchip: Fix platform_get_irq.cocci warning
   - stm32_fmc2: Add NAND Write Protect support
   - pl353: Set the nand chip node as the flash node
   - brcmnand: Fix sparse warnings in bcma_nand
   - omap_elm: Remove redundant variable 'errors'
   - gpmi:
      - Support fast edo timings for mx28
      - Validate controller clock rate
      - Fix controller timings setting
   - brcmnand:
      - Add BCMA shim
      - BCMA controller uses command shift of 0
      - Allow platform data instantation
      - Add platform data structure for BCMA
      - Allow working without interrupts
      - Move OF operations out of brcmnand_init_cs()
      - Avoid pdev in brcmnand_init_cs()
      - Allow SoC to provide I/O operations
      - Assign soc as early as possible

  Onenand changes:
   - Check for error irq

  SPI-NAND core changes:
   - Delay a little bit the dirmap creation
   - Create direct mapping descriptors for ECC operations

  SPI-NAND driver changes:
   - macronix: Use random program load

  SPI NOR core changes:
   - Move vendor specific code out of the core into vendor drivers.
   - Unify all function and object names in the vendor modules.
   - Make setup() callback optional to improve readability.
   - Skip erase logic when the SPI_NOR_NO_ERASE flag is set at flash
     declaration.

  SPI changes:
   - Macronix SPI controller:
      - Fix the transmit path
      - Create a helper to configure the controller before an operation
      - Create a helper to ease the start of an operation
      - Add support for direct mapping
      - Add support for pipelined ECC operations
   - spi-mem:
      - Introduce a capability structure
      - Check the controller extra capabilities
      - cadence-quadspi/mxic: Provide capability structures
      - Kill the spi_mem_dtr_supports_op() helper
      - Add an ecc parameter to the spi_mem_op structure

  Binding changes:
   - Dropped mtd/cortina,gemini-flash.txt
   - Convert BCM47xx partitions to json-schema
   - Vendor prefixes: Clarify Macronix prefix
   - SPI NAND: Convert spi-nand description file to yaml
   - Raw NAND chip: Create a NAND chip description
   - Raw NAND controller:
      - Harmonize the property types
      - Fix a comment in the examples
      - Fix the reg property description
   - Describe Macronix NAND ECC engine
   - Macronix SPI controller:
      - Document the nand-ecc-engine property
      - Convert to yaml
      - The interrupt property is not mandatory"

* tag 'mtd/changes-for-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (104 commits)
  mtd: nand: ecc: mxic: Fix compile test issue
  mtd: nand: mxic-ecc: make two read-only arrays static const
  mtd: hyperbus: HBMC_AM654 should depend on ARCH_K3
  mtd: core: Remove partid and partname debugfs files
  dt-bindings: mtd: partitions: convert BCM47xx to the json-schema
  mtd: tests: Fix eraseblock read speed miscalculation for lower partition sizes
  mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
  mtd: rawnand: rockchip: fix platform_get_irq.cocci warning
  mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set
  mtd: spi-nor: renumber flags
  mtd: spi-nor: slightly change code style in spi_nor_sr_ready()
  mtd: spi-nor: spansion: rename vendor specific functions and defines
  mtd: spi-nor: spansion: convert USE_CLSR to a manufacturer flag
  mtd: spi-nor: move all spansion specifics into spansion.c
  mtd: spi-nor: spansion: slightly rework control flow in late_init()
  mtd: spi-nor: micron-st: rename vendor specific functions and defines
  mtd: spi-nor: micron-st: convert USE_FSR to a manufacturer flag
  mtd: spi-nor: move all micron-st specifics into micron-st.c
  mtd: spi-nor: xilinx: correct the debug message
  mtd: spi-nor: xilinx: rename vendor specific functions and defines
  ...

mtd: core: Remove partid and partname debugfs files

2022-03-14T16:01:58+00:00

partid and partname debugfs files were used just by SPI NOR, but they were
replaced by sysfs entries. Since these debugfs files are no longer used in
mtd, remove dead code. The directory is kept as it is used by nandsim,
mtdswap and docg3.

Signed-off-by: Tudor Ambarus 
Reviewed-by: Pratyush Yadav 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20220225144656.634682-1-tudor.ambarus@microchip.com