linux-stable.git/drivers/mtd, branch v4.1.23

mtd: onenand: fix deadlock in onenand_block_markbad

2016-04-18T12:50:40+00:00

[ Upstream commit 5e64c29e98bfbba1b527b0a164f9493f3db9e8cb ]

Commit 5942ddbc500d ("mtd: introduce mtd_block_markbad interface")
incorrectly changed onenand_block_markbad() to call mtd_block_markbad
instead of onenand_chip's block_markbad function. As a result the function
will now recurse and deadlock. Fix by reverting the change.

Fixes: 5942ddbc500d ("mtd: introduce mtd_block_markbad interface")
Signed-off-by: Aaro Koskinen 
Acked-by: Artem Bityutskiy 
Cc: 
Signed-off-by: Brian Norris 
Signed-off-by: Sasha Levin

ubi: Fix out of bounds write in volume update code

2016-03-14T16:42:31+00:00

[ Upstream commit e4f6daac20332448529b11f09388f1d55ef2084c ]

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger 
Reviewed-by: Boris Brezillon 
Signed-off-by: Sasha Levin

UBI: return ENOSPC if no enough space available

2015-10-22T21:43:24+00:00

commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream.

UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI error: init_volumes: not enough PEBs, required 706, available 686
UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1)
UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 <= NOT ENOMEM
UBI error: ubi_init: cannot attach mtd1

If available PEBs are not enough when initializing volumes, return -ENOSPC
directly. If available PEBs are not enough when initializing WL, return
-ENOSPC instead of -ENOMEM.

Signed-off-by: Sheng Yong 
Signed-off-by: Richard Weinberger 
Reviewed-by: David Gstir 
Signed-off-by: Greg Kroah-Hartman

UBI: Validate data_size

2015-10-22T21:43:24+00:00

commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger 
Reviewed-by: David Gstir 
Signed-off-by: Greg Kroah-Hartman

mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions

2015-10-22T21:43:22+00:00

commit 03a0e8a7c5ea29b5c4e72dfd64900b47a8fb6f2d upstream.

The USER_DATA register cannot be accessed using byte accessors on A13
SoCs, thus triggering a bug when using memcpy_toio on this register.
Declare an helper macros to convert an OOB buffer into a suitable
USER_DATA value and vice-versa.

This patch also fixes an error in the oob_required logic (some OOB data
are not written even if the user required it) by removing the
oob_required condition, which is perfectly valid since the core already
fill ->oob_poi with FFs when oob_required is false.

Signed-off-by: Boris Brezillon 
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Signed-off-by: Brian Norris 
Signed-off-by: Greg Kroah-Hartman

mtd: nand: sunxi: fix sunxi_nand_chips_cleanup()

2015-10-22T21:43:22+00:00

commit 8e375ccda31ccc73b087134e263c48d2114534f4 upstream.

The sunxi_nand_chips_cleanup() function is missing a call to list_del()
which generates a double free error.

Reported-by: Priit Laes 
Signed-off-by: Boris Brezillon 
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Tested-by: Priit Laes 
Signed-off-by: Brian Norris 
Signed-off-by: Greg Kroah-Hartman

mtd: pxa3xx_nand: add a default chunk size

2015-10-22T21:43:22+00:00

commit bc3e00f04cc1fe033a289c2fc2e5c73c0168d360 upstream.

When keeping the configuration set by the bootloader (by using
the marvell,nand-keep-config property), the pxa3xx_nand_detect_config()
function is called and set the chunk size to 512 as a default value if
NDCR_PAGE_SZ is not set.

In the other case, when not keeping the bootloader configuration, no
chunk size is set. Fix this by adding a default chunk size of 512.

Fixes: 70ed85232a93 ("mtd: nand: pxa3xx: Introduce multiple page I/O
support")

Signed-off-by: Antoine Tenart 
Acked-by: Robert Jarzmik 
Signed-off-by: Brian Norris 
Signed-off-by: Greg Kroah-Hartman

mtd: dc21285: use raw spinlock functions for nw_gpio_lock

2015-07-21T17:10:05+00:00

commit e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 upstream.

Since commit bd31b85960a7 (which is in 3.2-rc1) nw_gpio_lock is a raw spinlock
that needs usage of the corresponding raw functions.

This fixes:

  drivers/mtd/maps/dc21285.c: In function 'nw_en_write':
  drivers/mtd/maps/dc21285.c:41:340: warning: passing argument 1 of 'spinlock_check' from incompatible pointer type
    spin_lock_irqsave(&nw_gpio_lock, flags);

  In file included from include/linux/seqlock.h:35:0,
                   from include/linux/time.h:5,
                   from include/linux/stat.h:18,
                   from include/linux/module.h:10,
                   from drivers/mtd/maps/dc21285.c:8:
  include/linux/spinlock.h:299:102: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
   static inline raw_spinlock_t *spinlock_check(spinlock_t *lock)
                                                                                                        ^
  drivers/mtd/maps/dc21285.c:43:25: warning: passing argument 1 of 'spin_unlock_irqrestore' from incompatible pointer type
    spin_unlock_irqrestore(&nw_gpio_lock, flags);
                           ^
  In file included from include/linux/seqlock.h:35:0,
                   from include/linux/time.h:5,
                   from include/linux/stat.h:18,
                   from include/linux/module.h:10,
                   from drivers/mtd/maps/dc21285.c:8:
  include/linux/spinlock.h:370:91: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
   static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)

Fixes: bd31b85960a7 ("locking, ARM: Annotate low level hw locks as raw")
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Brian Norris 
Signed-off-by: Greg Kroah-Hartman

mtd: fix: avoid race condition when accessing mtd->usecount

2015-07-21T17:10:05+00:00

commit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream.

On A MIPS 32-cores machine a BUG_ON was triggered because some acesses to
mtd->usecount were done without taking mtd_table_mutex.
kernel: Call Trace:
kernel: [] __put_mtd_device+0x20/0x50
kernel: [] blktrans_release+0x8c/0xd8
kernel: [] __blkdev_put+0x1a8/0x200
kernel: [] blkdev_close+0x1c/0x30
kernel: [] __fput+0xac/0x250
kernel: [] task_work_run+0xd8/0x120
kernel: [] work_notifysig+0x10/0x18
kernel:
kernel:
        Code: 2442ffff  ac8202d8  000217fe <00020336> dc820128  10400003
               00000000  0040f809  00000000
kernel: ---[ end trace 080fbb4579b47a73 ]---

Fixed by taking the mutex in blktrans_open and blktrans_release.

Note that this locking is already suggested in
include/linux/mtd/blktrans.h:

struct mtd_blktrans_ops {
...
	/* Called with mtd_table_mutex held; no race with add/remove */
	int (*open)(struct mtd_blktrans_dev *dev);
	void (*release)(struct mtd_blktrans_dev *dev);
...
};

But we weren't following it.

Originally reported by (and patched by) Zhang and Giuseppe,
independently. Improved and rewritten.

Reported-by: Zhang Xingcai 
Reported-by: Giuseppe Cantavenera 
Tested-by: Giuseppe Cantavenera 
Acked-by: Alexander Sverdlin 
Signed-off-by: Brian Norris 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'for-linus-20150516' of git://git.infradead.org/linux-mtd

2015-05-18T17:01:54+00:00

Pull MTD fixes from Brian Norris:
 "Two MTD fixes for 4.1:

   - readtest: the signal-handling code was clobbering the error codes
     we should be handling/reporting in this test, rendering it useless.
     Noticed by Coverity.

   - the common SPI NOR flash DT binding (merged for 4.1-rc1) is being
     revised, so let's change that before 4.1 is minted"

* tag 'for-linus-20150516' of git://git.infradead.org/linux-mtd:
  Documentation: dt: mtd: replace "nor-jedec" binding with "jedec, spi-nor"
  mtd: readtest: don't clobber error reports