linux-stable.git/drivers/mtd, branch v3.16.65

mtd: docg3: don't set conflicting BCH_CONST_PARAMS option

2019-02-11T17:53:48+00:00

commit be2e1c9dcf76886a83fb1c433a316e26d4ca2550 upstream.

I noticed during the creation of another bugfix that the BCH_CONST_PARAMS
option that is set by DOCG3 breaks setting variable parameters for any
other users of the BCH library code.

The only other user we have today is the MTD_NAND software BCH
implementation (most flash controllers use hardware BCH these days
and are not affected). I considered removing BCH_CONST_PARAMS entirely
because of the inherent conflict, but according to the description in
lib/bch.c there is a significant performance benefit in keeping it.

To avoid the immediate problem of the conflict between MTD_NAND_BCH
and DOCG3, this only sets the constant parameters if MTD_NAND_BCH
is disabled, which should fix the problem for all cases that
are affected. This should also work for all stable kernels.

Note that there is only one machine that actually seems to use the
DOCG3 driver (arch/arm/mach-pxa/mioa701.c), so most users should have
the driver disabled, but it almost certainly shows up if we wanted
to test random kernels on machines that use software BCH in MTD.

Fixes: d13d19ece39f ("mtd: docg3: add ECC correction code")
Cc: Robert Jarzmik 
Signed-off-by: Arnd Bergmann 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings

mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus

2019-02-11T17:53:29+00:00

commit 000412276370a9bcfec73b3752ceefd9a927f1db upstream.

fsl_qspi_get_seqid() may return -EINVAL, but fsl_qspi_init_ahb_read()
doesn't check for error codes with the result that -EINVAL could find
itself signalled over the bus.

In conjunction with the LS1046A SoC's A-009283 errata
("Illegal accesses to SPI flash memory can result in a system hang")
this illegal access to SPI flash memory results in a system hang
if userspace attempts reading later on.

Avoid this by always checking fsl_qspi_get_seqid()'s return value
and bail out otherwise.

Fixes: e46ecda764dc ("mtd: spi-nor: Add Freescale QuadSPI driver")
Signed-off-by: Ahmad Fatoum 
Signed-off-by: Boris Brezillon 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

mtd: spi-nor: fsl-quadspi: fix api naming typo _init_ahb_read

2019-02-11T17:53:29+00:00

commit dd50a1c4e56d6d2ea753f87a35b1f1e09cb877d7 upstream.

Fix api naming typo _init_ahb_read
fsl_qspi_init_abh_read --> fsl_qspi_init_ahb_read

Signed-off-by: Yogesh Gaur 
Acked-by: Han Xu 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings

mtd: fsl-quadspi: fix macro collision problems with READ/WRITE

2018-12-16T22:09:43+00:00

commit 04850c4d8613127a9b488321c0ad83bff7519311 upstream.

Change the READ/WRITE to FSL_READ/FSL_WRITE to resolve any possible
namespace collisions with READ/WRITE macros (e.g., from ).

Problems have been seen, for example, on mips:

>> drivers/mtd/spi-nor/fsl-quadspi.c:186:5: error: 'LUT_0' undeclared (first use in this function)
      ((LUT_##ins) << INSTR0_SHIFT))
        ^
>> drivers/mtd/spi-nor/fsl-quadspi.c:188:30: note: in expansion of macro 'LUT0'

On SPARC:

drivers/mtd/spi-nor/fsl-quadspi.c: In function 'fsl_qspi_init_lut':
drivers/mtd/spi-nor/fsl-quadspi.c:369:1: error: 'LUT_0' undeclared (first use in this function)
drivers/mtd/spi-nor/fsl-quadspi.c:418:1: error: pasting "LUT_" and "(" does not give a valid preprocessing token
drivers/mtd/spi-nor/fsl-quadspi.c:418:2: error: implicit declaration of function 'LUT_'

And surely on others.

Fixes: d26a22d06708 ("mtd: fsl-quadspi: allow building for other ARCHes with COMPILE_TEST")
Reported-by: Guenter Roeck 
Reported-by: kbuild test robot 
Signed-off-by: Han Xu 
[Brian: rewrote commit description]
Signed-off-by: Brian Norris 
Signed-off-by: Ben Hutchings

mtdchar: fix overflows in adjustment of `count`

2018-12-16T22:08:16+00:00

commit 6c6bc9ea84d0008024606bf5ba10519e20d851bf upstream.

The first checks in mtdchar_read() and mtdchar_write() attempt to limit
`count` such that `*ppos + count <= mtd->size`. However, they ignore the
possibility of `*ppos > mtd->size`, allowing the calculation of `count` to
wrap around. `mtdchar_lseek()` prevents seeking beyond mtd->size, but the
pread/pwrite syscalls bypass this.

I haven't found any codepath on which this actually causes dangerous
behavior, but it seems like a sensible change anyway.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jann Horn 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings

mtd: rawnand: mxc: remove __init qualifier from mxcnd_probe_dt

2018-12-16T22:08:16+00:00

commit 24f0ae995deb728076e3ea93fea1949a9775debf upstream.

Using the sysfs unbind, bind nodes, mxcnd_probe and mxcnd_probe_dt can
potentially be called at any time. After the __init functions are cleaned,
mxcnd_probe_dt is no longer available. Calling it anyway causes a crash.

mxcnd_probe used to be marked as __init, this was removed years ago.
Remove the __init qualifier from from mxcnd_probe_dt as well.

Fixes: 06f255106923 ("mtd: remove use of __devinit")
Signed-off-by: Martin Kaiser 
Reviewed-by: Boris Brezillon 
Signed-off-by: Miquel Raynal 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.

2018-11-20T18:05:24+00:00

commit f1ce87f6080b1dda7e7b1eda3da332add19d87b9 upstream.

cfi_ppb_unlock() walks all flash chips when unlocking sectors,
avoid walking chips unaffected by the unlock operation.

Fixes: 1648eaaa1575 ("mtd: cfi_cmdset_0002: Support Persistent Protection Bits (PPB) locking")
Signed-off-by: Joakim Tjernlund 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings

mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary

2018-11-20T18:05:22+00:00

commit 0cd8116f172eed018907303dbff5c112690eeb91 upstream.

The "sector is in requested range" test used to determine whether
sectors should be re-locked or not is done on a variable that is reset
everytime we cross a chip boundary, which can lead to some blocks being
re-locked while the caller expect them to be unlocked.
Fix the check to make sure this cannot happen.

Fixes: 1648eaaa1575 ("mtd: cfi_cmdset_0002: Support Persistent Protection Bits (PPB) locking")
Signed-off-by: Joakim Tjernlund 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings

mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips

2018-11-20T18:05:19+00:00

commit 5fdfc3dbad099281bf027a353d5786c09408a8e5 upstream.

cfi_ppb_unlock() tries to relock all sectors that were locked before
unlocking the whole chip.
This locking used the chip start address + the FULL offset from the
first flash chip, thereby forming an illegal address. Fix that by using
the chip offset(adr).

Fixes: 1648eaaa1575 ("mtd: cfi_cmdset_0002: Support Persistent Protection Bits (PPB) locking")
Signed-off-by: Joakim Tjernlund 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings

mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()

2018-11-20T18:05:19+00:00

commit f93aa8c4de307069c270b2d81741961162bead6c upstream.

do_ppb_xxlock() fails to add chip->start when querying for lock status
(and chip_ready test), which caused false status reports.
Fix that by adding adr += chip->start and adjust call sites
accordingly.

Fixes: 1648eaaa1575 ("mtd: cfi_cmdset_0002: Support Persistent Protection Bits (PPB) locking")
Signed-off-by: Joakim Tjernlund 
Signed-off-by: Boris Brezillon 
Signed-off-by: Ben Hutchings