<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/mtd, branch v3.16.35</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>mtd: onenand: fix deadlock in onenand_block_markbad</title>
<updated>2016-04-30T22:05:50+00:00</updated>
<author>
<name>Aaro Koskinen</name>
<email>aaro.koskinen@iki.fi</email>
</author>
<published>2016-02-20T20:27:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6c479a8fe44f57dc9f2cec60ab4ef637c80c35c6'/>
<id>6c479a8fe44f57dc9f2cec60ab4ef637c80c35c6</id>
<content type='text'>
commit 5e64c29e98bfbba1b527b0a164f9493f3db9e8cb upstream.

Commit 5942ddbc500d ("mtd: introduce mtd_block_markbad interface")
incorrectly changed onenand_block_markbad() to call mtd_block_markbad
instead of onenand_chip's block_markbad function. As a result the function
will now recurse and deadlock. Fix by reverting the change.

Fixes: 5942ddbc500d ("mtd: introduce mtd_block_markbad interface")
Signed-off-by: Aaro Koskinen &lt;aaro.koskinen@iki.fi&gt;
Acked-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5e64c29e98bfbba1b527b0a164f9493f3db9e8cb upstream.

Commit 5942ddbc500d ("mtd: introduce mtd_block_markbad interface")
incorrectly changed onenand_block_markbad() to call mtd_block_markbad
instead of onenand_chip's block_markbad function. As a result the function
will now recurse and deadlock. Fix by reverting the change.

Fixes: 5942ddbc500d ("mtd: introduce mtd_block_markbad interface")
Signed-off-by: Aaro Koskinen &lt;aaro.koskinen@iki.fi&gt;
Acked-by: Artem Bityutskiy &lt;artem.bityutskiy@linux.intel.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ubi: Fix out of bounds write in volume update code</title>
<updated>2016-03-24T10:01:05+00:00</updated>
<author>
<name>Richard Weinberger</name>
<email>richard@nod.at</email>
</author>
<published>2016-02-21T09:53:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=c3ad1774204ec2c77a608cd483b5f34f7490211d'/>
<id>c3ad1774204ec2c77a608cd483b5f34f7490211d</id>
<content type='text'>
commit e4f6daac20332448529b11f09388f1d55ef2084c upstream.

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req-&gt;upd_bytes +
ubi-&gt;min_io_size bytes.

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Reviewed-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e4f6daac20332448529b11f09388f1d55ef2084c upstream.

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req-&gt;upd_bytes +
ubi-&gt;min_io_size bytes.

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Reviewed-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mtd: nand: remove unused and buggy get_platform_nandchip() helper function</title>
<updated>2016-02-02T19:35:00+00:00</updated>
<author>
<name>Boris BREZILLON</name>
<email>boris.brezillon@free-electrons.com</email>
</author>
<published>2015-12-14T15:13:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f1b1b603033d86883b8c0cfd591d1ac93c680e5c'/>
<id>f1b1b603033d86883b8c0cfd591d1ac93c680e5c</id>
<content type='text'>
commit 8142b47ef33c655a34e08efd46b65732fe190675 upstream.

Nobody uses the get_platform_nandchip() helper function which is supposed
to return a pointer to a platform_nand_chip struct from an mtd_info
pointer.
Moreover, this function is buggy since the introduction of the plat_nand
layer (chip-&gt;priv is now storing a pointer to an intermediate
plat_nand_data structure allocated in plat_nand_probe(), and we have no
way to retrieve a pointer to the provided platform_nand_chip struct from
this plat_nand_data pointer).

While we are at it, remove the useless (and buggy, since it's pointing to
something stored on the stack) data-&gt;chip.priv assignment.

Signed-off-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Fixes: 711fdf627ce1 ("[MTD] [NAND] platform NAND driver: add driver")
Cc: Vitaly Wool &lt;vitalywool@gmail.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 8142b47ef33c655a34e08efd46b65732fe190675 upstream.

Nobody uses the get_platform_nandchip() helper function which is supposed
to return a pointer to a platform_nand_chip struct from an mtd_info
pointer.
Moreover, this function is buggy since the introduction of the plat_nand
layer (chip-&gt;priv is now storing a pointer to an intermediate
plat_nand_data structure allocated in plat_nand_probe(), and we have no
way to retrieve a pointer to the provided platform_nand_chip struct from
this plat_nand_data pointer).

While we are at it, remove the useless (and buggy, since it's pointing to
something stored on the stack) data-&gt;chip.priv assignment.

Signed-off-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Fixes: 711fdf627ce1 ("[MTD] [NAND] platform NAND driver: add driver")
Cc: Vitaly Wool &lt;vitalywool@gmail.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mtd: nand: denali: add missing nand_release() call in denali_remove()</title>
<updated>2016-02-02T19:31:48+00:00</updated>
<author>
<name>Boris BREZILLON</name>
<email>boris.brezillon@free-electrons.com</email>
</author>
<published>2015-12-11T14:02:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=82a58175ceda33ca4dba2249a4ced794f177ac39'/>
<id>82a58175ceda33ca4dba2249a4ced794f177ac39</id>
<content type='text'>
commit 320092a05dab2f44819c42f33d6b51efb6c474f2 upstream.

Unregister the NAND device from the NAND subsystem when removing a denali
NAND controller, otherwise the MTD attached to the NAND device is still
exposed by the MTD layer, and accesses to this device will likely crash
the system.

Fixes: 2a0a288ec258 ("mtd: denali: split the generic driver and PCI layer")
Signed-off-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Acked-by: Dinh Nguyen &lt;dinguyen@opensource.altera.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 320092a05dab2f44819c42f33d6b51efb6c474f2 upstream.

Unregister the NAND device from the NAND subsystem when removing a denali
NAND controller, otherwise the MTD attached to the NAND device is still
exposed by the MTD layer, and accesses to this device will likely crash
the system.

Fixes: 2a0a288ec258 ("mtd: denali: split the generic driver and PCI layer")
Signed-off-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Acked-by: Dinh Nguyen &lt;dinguyen@opensource.altera.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mtd: blkdevs: fix potential deadlock + lockdep warnings</title>
<updated>2015-12-13T17:49:00+00:00</updated>
<author>
<name>Brian Norris</name>
<email>computersforpeace@gmail.com</email>
</author>
<published>2015-10-26T17:20:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=9ea0602697ca3866a5457ac5e0767ffefe7bd64b'/>
<id>9ea0602697ca3866a5457ac5e0767ffefe7bd64b</id>
<content type='text'>
commit f3c63795e90f0c6238306883b6c72f14d5355721 upstream.

Commit 073db4a51ee4 ("mtd: fix: avoid race condition when accessing
mtd-&gt;usecount") fixed a race condition but due to poor ordering of the
mutex acquisition, introduced a potential deadlock.

The deadlock can occur, for example, when rmmod'ing the m25p80 module, which
will delete one or more MTDs, along with any corresponding mtdblock
devices. This could potentially race with an acquisition of the block
device as follows.

 -&gt; blktrans_open()
    -&gt;  mutex_lock(&amp;dev-&gt;lock);
    -&gt;  mutex_lock(&amp;mtd_table_mutex);

 -&gt; del_mtd_device()
    -&gt;  mutex_lock(&amp;mtd_table_mutex);
    -&gt;  blktrans_notify_remove() -&gt; del_mtd_blktrans_dev()
       -&gt;  mutex_lock(&amp;dev-&gt;lock);

This is a classic (potential) ABBA deadlock, which can be fixed by
making the A-&gt;B ordering consistent everywhere. There was no real
purpose to the ordering in the original patch, AFAIR, so this shouldn't
be a problem. This ordering was actually already present in
del_mtd_blktrans_dev(), for one, where the function tried to ensure that
its caller already held mtd_table_mutex before it acquired &amp;dev-&gt;lock:

        if (mutex_trylock(&amp;mtd_table_mutex)) {
                mutex_unlock(&amp;mtd_table_mutex);
                BUG();
        }

So, reverse the ordering of acquisition of &amp;dev-&gt;lock and &amp;mtd_table_mutex so
we always acquire mtd_table_mutex first.

Snippets of the lockdep output follow:

  # modprobe -r m25p80
  [   53.419251]
  [   53.420838] ======================================================
  [   53.427300] [ INFO: possible circular locking dependency detected ]
  [   53.433865] 4.3.0-rc6 #96 Not tainted
  [   53.437686] -------------------------------------------------------
  [   53.444220] modprobe/372 is trying to acquire lock:
  [   53.449320]  (&amp;new-&gt;lock){+.+...}, at: [&lt;c043fe4c&gt;] del_mtd_blktrans_dev+0x80/0xdc
  [   53.457271]
  [   53.457271] but task is already holding lock:
  [   53.463372]  (mtd_table_mutex){+.+.+.}, at: [&lt;c0439994&gt;] del_mtd_device+0x18/0x100
  [   53.471321]
  [   53.471321] which lock already depends on the new lock.
  [   53.471321]
  [   53.479856]
  [   53.479856] the existing dependency chain (in reverse order) is:
  [   53.487660]
  -&gt; #1 (mtd_table_mutex){+.+.+.}:
  [   53.492331]        [&lt;c043fc5c&gt;] blktrans_open+0x34/0x1a4
  [   53.497879]        [&lt;c01afce0&gt;] __blkdev_get+0xc4/0x3b0
  [   53.503364]        [&lt;c01b0bb8&gt;] blkdev_get+0x108/0x320
  [   53.508743]        [&lt;c01713c0&gt;] do_dentry_open+0x218/0x314
  [   53.514496]        [&lt;c0180454&gt;] path_openat+0x4c0/0xf9c
  [   53.519959]        [&lt;c0182044&gt;] do_filp_open+0x5c/0xc0
  [   53.525336]        [&lt;c0172758&gt;] do_sys_open+0xfc/0x1cc
  [   53.530716]        [&lt;c000f740&gt;] ret_fast_syscall+0x0/0x1c
  [   53.536375]
  -&gt; #0 (&amp;new-&gt;lock){+.+...}:
  [   53.540587]        [&lt;c063f124&gt;] mutex_lock_nested+0x38/0x3cc
  [   53.546504]        [&lt;c043fe4c&gt;] del_mtd_blktrans_dev+0x80/0xdc
  [   53.552606]        [&lt;c043f164&gt;] blktrans_notify_remove+0x7c/0x84
  [   53.558891]        [&lt;c04399f0&gt;] del_mtd_device+0x74/0x100
  [   53.564544]        [&lt;c043c670&gt;] del_mtd_partitions+0x80/0xc8
  [   53.570451]        [&lt;c0439aa0&gt;] mtd_device_unregister+0x24/0x48
  [   53.576637]        [&lt;c046ce6c&gt;] spi_drv_remove+0x1c/0x34
  [   53.582207]        [&lt;c03de0f0&gt;] __device_release_driver+0x88/0x114
  [   53.588663]        [&lt;c03de19c&gt;] device_release_driver+0x20/0x2c
  [   53.594843]        [&lt;c03dd9e8&gt;] bus_remove_device+0xd8/0x108
  [   53.600748]        [&lt;c03dacc0&gt;] device_del+0x10c/0x210
  [   53.606127]        [&lt;c03dadd0&gt;] device_unregister+0xc/0x20
  [   53.611849]        [&lt;c046d878&gt;] __unregister+0x10/0x20
  [   53.617211]        [&lt;c03da868&gt;] device_for_each_child+0x50/0x7c
  [   53.623387]        [&lt;c046eae8&gt;] spi_unregister_master+0x58/0x8c
  [   53.629578]        [&lt;c03e12f0&gt;] release_nodes+0x15c/0x1c8
  [   53.635223]        [&lt;c03de0f8&gt;] __device_release_driver+0x90/0x114
  [   53.641689]        [&lt;c03de900&gt;] driver_detach+0xb4/0xb8
  [   53.647147]        [&lt;c03ddc78&gt;] bus_remove_driver+0x4c/0xa0
  [   53.652970]        [&lt;c00cab50&gt;] SyS_delete_module+0x11c/0x1e4
  [   53.658976]        [&lt;c000f740&gt;] ret_fast_syscall+0x0/0x1c
  [   53.664621]
  [   53.664621] other info that might help us debug this:
  [   53.664621]
  [   53.672979]  Possible unsafe locking scenario:
  [   53.672979]
  [   53.679169]        CPU0                    CPU1
  [   53.683900]        ----                    ----
  [   53.688633]   lock(mtd_table_mutex);
  [   53.692383]                                lock(&amp;new-&gt;lock);
  [   53.698306]                                lock(mtd_table_mutex);
  [   53.704658]   lock(&amp;new-&gt;lock);
  [   53.707946]
  [   53.707946]  *** DEADLOCK ***

Fixes: 073db4a51ee4 ("mtd: fix: avoid race condition when accessing mtd-&gt;usecount")
Reported-by: Felipe Balbi &lt;balbi@ti.com&gt;
Tested-by: Felipe Balbi &lt;balbi@ti.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit f3c63795e90f0c6238306883b6c72f14d5355721 upstream.

Commit 073db4a51ee4 ("mtd: fix: avoid race condition when accessing
mtd-&gt;usecount") fixed a race condition but due to poor ordering of the
mutex acquisition, introduced a potential deadlock.

The deadlock can occur, for example, when rmmod'ing the m25p80 module, which
will delete one or more MTDs, along with any corresponding mtdblock
devices. This could potentially race with an acquisition of the block
device as follows.

 -&gt; blktrans_open()
    -&gt;  mutex_lock(&amp;dev-&gt;lock);
    -&gt;  mutex_lock(&amp;mtd_table_mutex);

 -&gt; del_mtd_device()
    -&gt;  mutex_lock(&amp;mtd_table_mutex);
    -&gt;  blktrans_notify_remove() -&gt; del_mtd_blktrans_dev()
       -&gt;  mutex_lock(&amp;dev-&gt;lock);

This is a classic (potential) ABBA deadlock, which can be fixed by
making the A-&gt;B ordering consistent everywhere. There was no real
purpose to the ordering in the original patch, AFAIR, so this shouldn't
be a problem. This ordering was actually already present in
del_mtd_blktrans_dev(), for one, where the function tried to ensure that
its caller already held mtd_table_mutex before it acquired &amp;dev-&gt;lock:

        if (mutex_trylock(&amp;mtd_table_mutex)) {
                mutex_unlock(&amp;mtd_table_mutex);
                BUG();
        }

So, reverse the ordering of acquisition of &amp;dev-&gt;lock and &amp;mtd_table_mutex so
we always acquire mtd_table_mutex first.

Snippets of the lockdep output follow:

  # modprobe -r m25p80
  [   53.419251]
  [   53.420838] ======================================================
  [   53.427300] [ INFO: possible circular locking dependency detected ]
  [   53.433865] 4.3.0-rc6 #96 Not tainted
  [   53.437686] -------------------------------------------------------
  [   53.444220] modprobe/372 is trying to acquire lock:
  [   53.449320]  (&amp;new-&gt;lock){+.+...}, at: [&lt;c043fe4c&gt;] del_mtd_blktrans_dev+0x80/0xdc
  [   53.457271]
  [   53.457271] but task is already holding lock:
  [   53.463372]  (mtd_table_mutex){+.+.+.}, at: [&lt;c0439994&gt;] del_mtd_device+0x18/0x100
  [   53.471321]
  [   53.471321] which lock already depends on the new lock.
  [   53.471321]
  [   53.479856]
  [   53.479856] the existing dependency chain (in reverse order) is:
  [   53.487660]
  -&gt; #1 (mtd_table_mutex){+.+.+.}:
  [   53.492331]        [&lt;c043fc5c&gt;] blktrans_open+0x34/0x1a4
  [   53.497879]        [&lt;c01afce0&gt;] __blkdev_get+0xc4/0x3b0
  [   53.503364]        [&lt;c01b0bb8&gt;] blkdev_get+0x108/0x320
  [   53.508743]        [&lt;c01713c0&gt;] do_dentry_open+0x218/0x314
  [   53.514496]        [&lt;c0180454&gt;] path_openat+0x4c0/0xf9c
  [   53.519959]        [&lt;c0182044&gt;] do_filp_open+0x5c/0xc0
  [   53.525336]        [&lt;c0172758&gt;] do_sys_open+0xfc/0x1cc
  [   53.530716]        [&lt;c000f740&gt;] ret_fast_syscall+0x0/0x1c
  [   53.536375]
  -&gt; #0 (&amp;new-&gt;lock){+.+...}:
  [   53.540587]        [&lt;c063f124&gt;] mutex_lock_nested+0x38/0x3cc
  [   53.546504]        [&lt;c043fe4c&gt;] del_mtd_blktrans_dev+0x80/0xdc
  [   53.552606]        [&lt;c043f164&gt;] blktrans_notify_remove+0x7c/0x84
  [   53.558891]        [&lt;c04399f0&gt;] del_mtd_device+0x74/0x100
  [   53.564544]        [&lt;c043c670&gt;] del_mtd_partitions+0x80/0xc8
  [   53.570451]        [&lt;c0439aa0&gt;] mtd_device_unregister+0x24/0x48
  [   53.576637]        [&lt;c046ce6c&gt;] spi_drv_remove+0x1c/0x34
  [   53.582207]        [&lt;c03de0f0&gt;] __device_release_driver+0x88/0x114
  [   53.588663]        [&lt;c03de19c&gt;] device_release_driver+0x20/0x2c
  [   53.594843]        [&lt;c03dd9e8&gt;] bus_remove_device+0xd8/0x108
  [   53.600748]        [&lt;c03dacc0&gt;] device_del+0x10c/0x210
  [   53.606127]        [&lt;c03dadd0&gt;] device_unregister+0xc/0x20
  [   53.611849]        [&lt;c046d878&gt;] __unregister+0x10/0x20
  [   53.617211]        [&lt;c03da868&gt;] device_for_each_child+0x50/0x7c
  [   53.623387]        [&lt;c046eae8&gt;] spi_unregister_master+0x58/0x8c
  [   53.629578]        [&lt;c03e12f0&gt;] release_nodes+0x15c/0x1c8
  [   53.635223]        [&lt;c03de0f8&gt;] __device_release_driver+0x90/0x114
  [   53.641689]        [&lt;c03de900&gt;] driver_detach+0xb4/0xb8
  [   53.647147]        [&lt;c03ddc78&gt;] bus_remove_driver+0x4c/0xa0
  [   53.652970]        [&lt;c00cab50&gt;] SyS_delete_module+0x11c/0x1e4
  [   53.658976]        [&lt;c000f740&gt;] ret_fast_syscall+0x0/0x1c
  [   53.664621]
  [   53.664621] other info that might help us debug this:
  [   53.664621]
  [   53.672979]  Possible unsafe locking scenario:
  [   53.672979]
  [   53.679169]        CPU0                    CPU1
  [   53.683900]        ----                    ----
  [   53.688633]   lock(mtd_table_mutex);
  [   53.692383]                                lock(&amp;new-&gt;lock);
  [   53.698306]                                lock(mtd_table_mutex);
  [   53.704658]   lock(&amp;new-&gt;lock);
  [   53.707946]
  [   53.707946]  *** DEADLOCK ***

Fixes: 073db4a51ee4 ("mtd: fix: avoid race condition when accessing mtd-&gt;usecount")
Reported-by: Felipe Balbi &lt;balbi@ti.com&gt;
Tested-by: Felipe Balbi &lt;balbi@ti.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mtd: mtdpart: fix add_mtd_partitions error path</title>
<updated>2015-12-09T11:40:58+00:00</updated>
<author>
<name>Boris BREZILLON</name>
<email>boris.brezillon@free-electrons.com</email>
</author>
<published>2015-07-30T10:18:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=74dce55ccaec23e148a09cd34242300aaf4e666b'/>
<id>74dce55ccaec23e148a09cd34242300aaf4e666b</id>
<content type='text'>
commit e5bae86797141e4a95e42d825f737cb36d7b8c37 upstream.

If we fail to allocate a partition structure in the middle of the partition
creation process, the already allocated partitions are never removed, which
means they are still present in the partition list and their resources are
never freed.

Signed-off-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e5bae86797141e4a95e42d825f737cb36d7b8c37 upstream.

If we fail to allocate a partition structure in the middle of the partition
creation process, the already allocated partitions are never removed, which
means they are still present in the partition list and their resources are
never freed.

Signed-off-by: Boris Brezillon &lt;boris.brezillon@free-electrons.com&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: return ENOSPC if no enough space available</title>
<updated>2015-10-19T14:47:00+00:00</updated>
<author>
<name>shengyong</name>
<email>shengyong1@huawei.com</email>
</author>
<published>2015-09-28T17:57:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=05743f7bfd545cec3b9bcf5c69905262285cdc25'/>
<id>05743f7bfd545cec3b9bcf5c69905262285cdc25</id>
<content type='text'>
commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream.

UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI error: init_volumes: not enough PEBs, required 706, available 686
UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1)
UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 &lt;= NOT ENOMEM
UBI error: ubi_init: cannot attach mtd1

If available PEBs are not enough when initializing volumes, return -ENOSPC
directly. If available PEBs are not enough when initializing WL, return
-ENOSPC instead of -ENOMEM.

Signed-off-by: Sheng Yong &lt;shengyong1@huawei.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Reviewed-by: David Gstir &lt;david@sigma-star.at&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream.

UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI error: init_volumes: not enough PEBs, required 706, available 686
UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1)
UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 &lt;= NOT ENOMEM
UBI error: ubi_init: cannot attach mtd1

If available PEBs are not enough when initializing volumes, return -ENOSPC
directly. If available PEBs are not enough when initializing WL, return
-ENOSPC instead of -ENOMEM.

Signed-off-by: Sheng Yong &lt;shengyong1@huawei.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Reviewed-by: David Gstir &lt;david@sigma-star.at&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: Validate data_size</title>
<updated>2015-10-19T14:42:37+00:00</updated>
<author>
<name>Richard Weinberger</name>
<email>richard@nod.at</email>
</author>
<published>2015-09-22T21:58:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=80fe92d4075b6b72a371b7bfa4093f2bfa02f321'/>
<id>80fe92d4075b6b72a371b7bfa4093f2bfa02f321</id>
<content type='text'>
commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Reviewed-by: David Gstir &lt;david@sigma-star.at&gt;
[ luis: backported to 3.16:
  - no ubi_device parameter for the ubi_err() macro in 3.16 ]
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
Reviewed-by: David Gstir &lt;david@sigma-star.at&gt;
[ luis: backported to 3.16:
  - no ubi_device parameter for the ubi_err() macro in 3.16 ]
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>UBI: block: Add missing cache flushes</title>
<updated>2015-09-30T12:20:56+00:00</updated>
<author>
<name>Kevin Cernekee</name>
<email>cernekee@chromium.org</email>
</author>
<published>2015-04-22T12:30:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=afdef6bea4c4b188dcb898ff2de550dd5064ecf1'/>
<id>afdef6bea4c4b188dcb898ff2de550dd5064ecf1</id>
<content type='text'>
commit 98fb1ffd8154890d7051750e61ff5548c3ee2ab2 upstream.

Block drivers are responsible for calling flush_dcache_page() on each
BIO request. This operation keeps the I$ coherent with the D$ on
architectures that don't have hardware coherency support. Without this
flush, random crashes are seen when executing user programs from an ext4
filesystem backed by a ubiblock device.

This patch is based on the change implemented in commit 2d4dc890b5c8
("block: add helpers to run flush_dcache_page() against a bio and a
request's pages").

Fixes: 9d54c8a33eec ("UBI: R/O block driver on top of UBI volumes")
Signed-off-by: Kevin Cernekee &lt;cernekee@chromium.org&gt;
Signed-off-by: Ezequiel Garcia &lt;ezequiel.garcia@imgtec.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
[ luis: backported to 3.16: used Kevin's backport to 3.14 ]
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 98fb1ffd8154890d7051750e61ff5548c3ee2ab2 upstream.

Block drivers are responsible for calling flush_dcache_page() on each
BIO request. This operation keeps the I$ coherent with the D$ on
architectures that don't have hardware coherency support. Without this
flush, random crashes are seen when executing user programs from an ext4
filesystem backed by a ubiblock device.

This patch is based on the change implemented in commit 2d4dc890b5c8
("block: add helpers to run flush_dcache_page() against a bio and a
request's pages").

Fixes: 9d54c8a33eec ("UBI: R/O block driver on top of UBI volumes")
Signed-off-by: Kevin Cernekee &lt;cernekee@chromium.org&gt;
Signed-off-by: Ezequiel Garcia &lt;ezequiel.garcia@imgtec.com&gt;
Signed-off-by: Richard Weinberger &lt;richard@nod.at&gt;
[ luis: backported to 3.16: used Kevin's backport to 3.14 ]
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mtd: pxa3xx_nand: add a default chunk size</title>
<updated>2015-09-30T12:20:45+00:00</updated>
<author>
<name>Antoine Ténart</name>
<email>antoine.tenart@free-electrons.com</email>
</author>
<published>2015-08-18T08:59:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=38928d9fbbd15d3fd957c97e65aac5e0f7e2f860'/>
<id>38928d9fbbd15d3fd957c97e65aac5e0f7e2f860</id>
<content type='text'>
commit bc3e00f04cc1fe033a289c2fc2e5c73c0168d360 upstream.

When keeping the configuration set by the bootloader (by using
the marvell,nand-keep-config property), the pxa3xx_nand_detect_config()
function is called and set the chunk size to 512 as a default value if
NDCR_PAGE_SZ is not set.

In the other case, when not keeping the bootloader configuration, no
chunk size is set. Fix this by adding a default chunk size of 512.

Fixes: 70ed85232a93 ("mtd: nand: pxa3xx: Introduce multiple page I/O
support")

Signed-off-by: Antoine Tenart &lt;antoine.tenart@free-electrons.com&gt;
Acked-by: Robert Jarzmik &lt;robert.jarzmik@free&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit bc3e00f04cc1fe033a289c2fc2e5c73c0168d360 upstream.

When keeping the configuration set by the bootloader (by using
the marvell,nand-keep-config property), the pxa3xx_nand_detect_config()
function is called and set the chunk size to 512 as a default value if
NDCR_PAGE_SZ is not set.

In the other case, when not keeping the bootloader configuration, no
chunk size is set. Fix this by adding a default chunk size of 512.

Fixes: 70ed85232a93 ("mtd: nand: pxa3xx: Introduce multiple page I/O
support")

Signed-off-by: Antoine Tenart &lt;antoine.tenart@free-electrons.com&gt;
Acked-by: Robert Jarzmik &lt;robert.jarzmik@free&gt;
Signed-off-by: Brian Norris &lt;computersforpeace@gmail.com&gt;
Signed-off-by: Luis Henriques &lt;luis.henriques@canonical.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
