linux-stable.git/drivers/mtd, branch v7.2.5

mtd: rawnand: validate ONFI extended parameter page sections

2026-09-11T09:50:58+00:00

commit e5e415262330bd70f983e091d8919d9dcd99e475 upstream.

nand_flash_detect_ext_param_page() allocates the length declared by the
ONFI parameter page, then treats the data as a fixed header followed by
variable-length sections. It reads that header and advances over sections
without first proving that the fixed page and each current section fit in
the allocation.

Reject pages shorter than the fixed header, track the remaining variable
area while walking sections, and require the ECC section to contain every
field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics
that identify the malformed ONFI section.

Fixes: 6dcbe0cdd83f ("mtd: get the ECC info from the Extended Parameter Page")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: rawnand: sunxi: fix H6/H616 controller timings

2026-09-11T09:50:58+00:00

commit 15a3cbce32994141252bb4ecfe3ff3a5d22d0b4f upstream.

The NAND timing calculation assumes that command and address setup and
hold intervals T1-T4, T7 and T11 each take one controller clock. It also
uses the original A10 delay encodings for tWB, tADL, tWHR and tRHW.

The H6/H616 NDFC defines the setup and hold intervals as two internal
clock cycles and uses different delay encodings. Add the H616 timing
characteristics and select them through the controller capability data so
the clock solver and timing fields match the hardware.

Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: rawnand: sunxi: describe tADL and tWHR delays

2026-09-11T09:50:58+00:00

commit 147f2a5743f8864bfc265654b1856af11c8c0031 upstream.

The tADL and tWHR timing fields use four encoded delays, but the driver
currently derives their values with a shift. This hides the actual
controller timing characteristics and lets the clock solver select a
32-cycle delay that the fields cannot encode.

Describe the legacy 7, 15, 23 and 31 cycle thresholds explicitly and use
the tables for both clock selection and field lookup. This prepares the
driver for controllers with different encodings.

Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: rawnand: sunxi: group controller delay tables

2026-09-11T09:50:57+00:00

commit 9f2e033754c6c023150f184b4e72bbcc5d6eea13 upstream.

The tWB and tRHW timing field encodings are controller properties, but
they currently live in standalone lookup tables.

Group them in a timing descriptor selected through the controller
capability data. Point every existing controller at the legacy values so
this is a pure preparation change.

Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses

2026-09-11T09:50:57+00:00

commit 80ecacd054ffeb60cd28e46ed5cd6bd0d2de318b upstream.

Any access not using the hardware ECC engine should be monolithic
because the controller has its very own way of handling the end of a
transaction during operation configuration, so we cannot easily make
repeated reads.

This has the side effect of fixing support for software ECC engines.

Suggested-by: Andrea Scian 
Cc: stable@vger.kernel.org
Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
Signed-off-by: Miquel Raynal (DAVE) 
Acked-by: Michal Simek 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()

2026-09-11T09:50:57+00:00

commit 5b2444b4d575d8117809c57801562ef37ca2d4af upstream.

The Realtek external ECC engine driver has an OF match table wired into
its platform driver, but the table is not exported with
MODULE_DEVICE_TABLE().

When the driver is built as a module, the missing OF module alias
prevents automatic module loading from the compatible string.

Add the missing MODULE_DEVICE_TABLE() entry.

Fixes: 3148d0e5b1c5 ("mtd: nand: realtek-ecc: Add Realtek external ECC engine support")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: mtdoops: free page bitmap when the backing MTD is removed

2026-09-11T09:50:57+00:00

commit 956e7da12c114f13c63d126ab1d79c3b6a819060 upstream.

mtdoops_notify_add() allocates oops_page_used when the configured MTD
device is registered.  mtdoops_notify_remove() detaches from that device
but leaves the bitmap allocated.  If the same MTD device is later
registered again, the add path allocates a new bitmap and overwrites the
old pointer, leaking one vmalloc allocation per remove/add cycle.

This is only visible when the backing MTD device can disappear and be
registered again while mtdoops remains loaded, so the usual static MTD
case does not expose it.

Free the bitmap after unregistering the dumper and flushing the pending
workers, then clear the pointer and page count before a later attach can
allocate fresh state.  Clearing the pointer also keeps the module exit
path from freeing the same bitmap a second time after a remove event.

Fixes: be95745f0167 ("mtd: mtdoops: keep track of used/unused pages in an array")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

mtd: afs: validate v2 image info bounds

2026-09-11T09:50:57+00:00

commit e9290031f736e99ad17c25c00311c92c266843b7 upstream.

The AFS v2 parser uses footer[8] to locate the image information block
inside the current erase block, then uses the image information
region_count to walk entries from a fixed local array. The footer offset
and region count come from flash contents and are not checked against the
erase block or the local image-info array before use.

Reject v2 entries whose image information offset would underflow the
erase block calculation, and reject region counts that cannot fit in the
local image-info array before walking region entries.

Fixes: b7cf5e2830bb ("mtd: afs: add v2 partition parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou 
Acked-by: Linus Walleij 
Signed-off-by: Miquel Raynal 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2026-07-17T16:30:17+00:00

Pull mtd fixes from Miquel Raynal:
 "Among the most important fixes that we have here, there are:

   - the revert of the uclinux map driver which was presumed to
     be no longer used but in fact was

   - the use of SPI match data to get chip capabilities in the
     mchp23k256 driver

   - several fixes addressing the newly introduced virt-concat
     support

   - a missing build dependency on ndfc

  as well as the usual load (if not actually bigger than usual) of
  uninitialized variables, leaks, double free, and AI fuzzed issues
  being fixed"

* tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  Revert "mtd: maps: remove uclinux map driver"
  mtd: onenand: samsung: report DMA completion timeouts
  mtd: rawnand: fsl_ifc: return errors for failed page reads
  mtd: mchp23k256: use SPI match data for chip caps
  mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
  mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
  mtd: fix double free and WARN_ON in add_mtd_device() error paths
  mtd: virt-concat: free duplicate generated name
  mtd: nand: mtk-ecc: stop on ECC idle timeouts
  mtd: mtdswap: remove debugfs stats file on teardown
  mtd: mtdpart: validate partition bounds in mtd_add_partition()
  mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path
  mtd: rawnand: ndfc: add CONFIG_OF dependency
  mtd: spinand: initialize ret in regular page reads
  mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
  mtd: rawnand: ingenic: handle ECC clock enable failures
  mtd: nand: ecc-mtk: handle ECC clock enable failures
  mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
  mtd: rawnand: ndfc: fix gcc uninitialized var

Revert "mtd: maps: remove uclinux map driver"

2026-07-03T13:46:28+00:00

The uclinux MTD map driver is still actively used on ColdFire (m68k)
platforms. The ColdFire startup code in arch/m68k/coldfire/head.S copies
an attached filesystem blob to _bss_stop, and the uclinux driver picks
it up from there. Most ColdFire defconfigs enable CONFIG_MTD_UCLINUX, as
the driver seems to serve as a replacement for CONFIG_BLK_DEV_INITRD on
these non-MMU targets.

The driver was removed as part of a series cleaning up AMD Élan specific
drivers, but unlike the other three drivers in that series, this driver
seemed to not be as Élan specific (nor unused) as initially thought.

This reverts commit c584b8a7ad01a334a89732f3c5791ba14e58642b.

Reported-by: Greg Ungerer 
Closes: https://lore.kernel.org/all/b55ac37f-4523-46d0-8e77-3a17d7235ffe@westnet.com.au/
Acked-by: Arnd Bergmann 
Signed-off-by: Miquel Raynal