linux.git/drivers/mtd/mtdcore.c, branch v6.15

mtd: Fix error handling in mtd_device_parse_register() error path

2025-03-04T11:07:30+00:00

Check and log del_mtd_device() failures. Print an error message
with pr_err() to prevent silent failures, but preserve the original
error code instead of propagating the secondary error since
del_mtd_device() is already in an error handling path.

Signed-off-by: Wentao Liang 
Signed-off-by: Miquel Raynal

mtd: capture device name setting failure when adding mtd

2025-03-04T11:07:08+00:00

syzbot reported a WARNING in release_mtd_partition. [1]

The reproducer uses "/proc/thread-self/fail-nth" to trigger the failure
of memory allocation when executing dev_set_name() in add_mtd_device(),
which eventually causes device_register() to fail because the device name
is not set, and finally triggers a warning in put_device().

[1]
WARNING: CPU: 0 PID: 5826 at drivers/mtd/mtdpart.c:37 release_mtd_partition+0x71/0x90 drivers/mtd/mtdpart.c:37
Modules linked in:
CPU: 0 UID: 0 PID: 5826 Comm: syz-executor397 Not tainted 6.13.0-syzkaller-09734-g2a9f04bde07a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:release_mtd_partition+0x71/0x90 drivers/mtd/mtdpart.c:37
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 1e 48 8b 7b 38 e8 ef 84 cd fb 48 89 df 5b 5d e9 e5 84 cd fb e8 70 4a 75 fb 90 <0f> 0b 90 eb c2 e8 a5 29 d8 fb eb db 48 89 ef e8 9b 29 d8 fb eb a5
RSP: 0018:ffffc90003e1f828 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802c1d1000 RCX: ffffffff8b417995
RDX: ffff8880310c3c00 RSI: ffffffff86439150 RDI: ffff88802c1d1000
RBP: ffff88802c1d1648 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000004 R11: ffffffff81000130 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000055558b9cd480(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 0000000034aca000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 
 mtd_release+0xa0/0xd0 drivers/mtd/mtdcore.c:101
 device_release+0xa1/0x240 drivers/base/core.c:2567
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e4/0x5a0 lib/kobject.c:737
 put_device+0x1f/0x30 drivers/base/core.c:3773
 add_mtd_device+0xbb3/0x1700 drivers/mtd/mtdcore.c:750
 mtd_add_partition+0x300/0x650 drivers/mtd/mtdpart.c:279
 mtdchar_blkpg_ioctl+0x20d/0x250 drivers/mtd/mtdchar.c:562
 mtdchar_ioctl+0xbbe/0x2050 drivers/mtd/mtdchar.c:1216
 mtdchar_unlocked_ioctl+0xb0/0xf0 drivers/mtd/mtdchar.c:1239
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl fs/ioctl.c:892 [inline]
 __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported-by: syzbot+074732af3fc6c528f8a0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=074732af3fc6c528f8a0
Tested-by: syzbot+074732af3fc6c528f8a0@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis 
Signed-off-by: Miquel Raynal

Merge tag 'mtd/for-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2024-05-16T16:04:52+00:00

Pull MTD updates from Miquel Raynal:
 "MTD:

   - Simon Glass wanted to support binman's output properties in order
     to check their validity using the binding checks and proposed
     changes with the missing properties as well as a binman compatible.

   - Krzysztof Kozlowski on his side shared a new yaml for describing
     Samsung's OneNAND interface.

   - The interface with NVMEM has also been slightly improved/fixed,
     especially now that OTP are also supported in the NAND subsystem.

   - Along with these changes, small cleanups have also been contributed
     around ID tables, structure sizes, arithmetic checks and comments.

  Raw NAND subsystem:

   - Two small fixes, one in the Hynix vendor code for properly
     returning an error which might have been ignored and another in the
     Davinci driver to properly synchronize the controller with the gpio
     domain.

  SPI NOR subsystem:

   - SPI NOR now uses div_u64() instead of div64_u64() in places where
     the divisor is 32 bits. Many 32 bit architectures can optimize this
     variant better than a full 64 bit divide"

* tag 'mtd/for-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: spi-nor: replace unnecessary div64_u64() with div_u64()
  mtd: mchp23k256: drop unneeded MODULE_ALIAS
  dt-bindings: mtd: fixed-partition: Add binman compatibles
  dt-bindings: mtd: fixed-partitions: Add alignment properties
  mtd: maps: sa1100-flash: Prefer struct_size over open coded arithmetic
  mtd: core: Align comment with an action in mtd_otp_nvmem_add()
  mtd: rawnand: hynix: fixed typo
  mtd: rawnand: davinci: Add dummy read after sending command
  mtd: partitions: redboot: Added conversion of operands to a larger type
  dt-bindings: mtd: Add Samsung S5Pv210 OneNAND
  mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported
  mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()

mtd: limit OTP NVMEM cell parse to non-NAND devices

2024-04-15T10:04:37+00:00

MTD OTP logic is very fragile on parsing NVMEM cell and can be
problematic with some specific kind of devices.

The problem was discovered by e87161321a40 ("mtd: rawnand: macronix:
OTP access for MX30LFxG18AC") where OTP support was added to a NAND
device. With the case of NAND devices, it does require a node where ECC
info are declared and all the fixed partitions, and this cause the OTP
codepath to parse this node as OTP NVMEM cells, making probe fail and
the NAND device registration fail.

MTD OTP parsing should have been limited to always using compatible to
prevent this error by using node with compatible "otp-user" or
"otp-factory".

NVMEM across the years had various iteration on how cells could be
declared in DT, in some old implementation, no_of_node should have been
enabled but now add_legacy_fixed_of_cells should be used to disable
NVMEM to parse child node as NVMEM cell.

To fix this and limit any regression with other MTD that makes use of
declaring OTP as direct child of the dev node, disable
add_legacy_fixed_of_cells if we detect the MTD type is Nand.

With the following logic, the OTP NVMEM entry is correctly created with
no cells and the MTD Nand is correctly probed and partitions are
correctly exposed.

Fixes: 4b361cfa8624 ("mtd: core: add OTP nvmem provider support")
Cc:  # v6.7+
Signed-off-by: Christian Marangi 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20240412105030.1598-1-ansuelsmth@gmail.com

mtd: core: Align comment with an action in mtd_otp_nvmem_add()

2024-04-09T06:35:34+00:00

The comment is related to the non-error case, make it more clear
by inverting the condition. It also makes code neater at the end.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Pratyush Yadav 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20240325151150.3368658-1-andriy.shevchenko@linux.intel.com

mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported

2024-03-25T09:26:55+00:00

Handle the case where -EOPNOTSUPP is returned from OTP driver.

This addresses an issue that occurs with the Intel SPI flash controller,
which has a limited supported opcode set. Whilst the OTP functionality
is not available due to this restriction, other parts of the MTD
functionality of the device are intact. This change allows the driver
to gracefully handle the restriction by allowing the supported
functionality to remain available instead of failing the probe
altogether.

Signed-off-by: Aapo Vienamo 
Reviewed-by: Mika Westerberg 
Reviewed-by: Michael Walle 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20240313173425.1325790-3-aapo.vienamo@linux.intel.com

mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add()

2024-03-25T09:26:53+00:00

Jump to the error reporting code in mtd_otp_nvmem_add() if the
mtd_otp_size() call fails. Without this fix, the error is not logged.

Signed-off-by: Aapo Vienamo 
Reviewed-by: Mika Westerberg 
Reviewed-by: Michael Walle 
Fixes: 4b361cfa8624 ("mtd: core: add OTP nvmem provider support")
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20240313173425.1325790-2-aapo.vienamo@linux.intel.com

mtd: Fix possible refcounting issue when going through partition nodes

2024-02-05T12:39:33+00:00

Under normal conditions, the loop goes over all child partitions, and
'breaks' when the relevant partition is found. In this case we get a
reference to the partition node without ever releasing it. Indeed, right
after the mtd_check_of_node() function returns, we call of_node_get()
again over this very same node. It is probably safer to keep the
counters even in this helper and call of_node_put() before break-ing.

Reported-by: kernel test robot 
Reported-by: Julia Lawall 
Closes: https://lore.kernel.org/r/202312250546.ISzglvM2-lkp@intel.com/
Cc: Christian Marangi 
Cc: Rafał Miłecki 
Signed-off-by: Miquel Raynal 
Link: https://lore.kernel.org/linux-mtd/20240104081446.126540-1-miquel.raynal@bootlin.com

mtd: Add several functions to the fail_function list

2024-01-06T22:47:07+00:00

add mtd_read(), mtd_write(), mtd_erase(), mtd_block_markbad() to
fail_function list for testing purpose

- Specify the function to inject the fault
echo mtd_read > /sys/kernel/debug/fail_function/inject

- Specifies the return value of the function to inject the fault
printf %#x -12 > /sys/kernel/debug/fail_function/mtd_read/retval

- Specify other fault injection configuration parameters.
echo -1 > /sys/kernel/debug/fail_function/times
echo 100 > /sys/kernel/debug/fail_function/probability
echo 15 > /sys/kernel/debug/fail_function/space

Signed-off-by: ZhaoLong Wang 
Reviewed-by: Zhihao Cheng 
Signed-off-by: Richard Weinberger

Merge tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2023-11-04T21:04:30+00:00

Pull mtd updates from Miquel Raynal:
 "The main set of changes is related to Uwe's work converting platform
  remove callbacks to return void. Comes next (in number of changes)
  Kees' additional structures annotations to improve the sanitizers. The
  usual amount of cleanups apply.

  About the more substancial contribution, one main function of the
  partitions core could return an error which was not checked, this is
  now fixed. On the bindings side, fixed partitions can now have a
  compression property. Finally, an erroneous situation is now always
  avoided in the MAP RAM driver.

  CFI:

   - A several years old byte swap has been fixed.

  NAND:

   - The subsystem has, as usual, seen a bit of cleanup being done this
     cycle, typically return values of platform_get_irq() and
     devm_kasprintf(). There is also a better ECC check in the Arasan
     driver. This comes with smaller misc changes.

   - In the SPI-NAND world there is now support for Foresee F35SQA002G,
     Winbond W25N and XTX XT26 chips.

  SPI NOR:

   - For SPI NOR we cleaned the flash info entries in order to have them
     slimmer and self explanatory. In order to make the entries as slim
     as possible, we introduced sane default values so that the actual
     flash entries don't need to specify them. We now use a flexible
     macro to specify the flash ID instead of the previous INFOx()
     macros that had hardcoded ID lengths.

     Instead of:

         { "w25q512nwm", INFO(0xef8020, 0, 64 * 1024, 0)
                 OTP_INFO(256, 3, 0x1000, 0x1000) },

     We now use:

         .id = SNOR_ID(0xef, 0x80, 0x20),
         .name = "w25q512nwm",
         .otp = SNOR_OTP(256, 3, 0x1000, 0x1000),

   - We also removed some flash entries: the very old Catalyst SPI
     EEPROMs that were introduced once with the SPI-NOR subsystem, and a
     Fujitsu MRAM. Both should use the at25 EEPROM driver. The latter
     even has device tree bindings for the at25 driver.

   - We made sure that the conversion didn't introduce any unwanted
     changes by comparing the .rodata segment before and after the
     conversion. The patches landed in linux-next immediately after
     v6.6-rc2, we haven't seen any regressions yet.

   - Apart of the autumn cleaning we introduced a new flash entry,
     at25ff321a, and added block protection support for mt25qu512a"

* tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (91 commits)
  mtd: cfi_cmdset_0001: Byte swap OTP info
  mtd: rawnand: meson: check return value of devm_kasprintf()
  mtd: rawnand: intel: check return value of devm_kasprintf()
  mtd: rawnand: sh_flctl: Convert to module_platform_driver()
  mtd: spi-nor: micron-st: use SFDP table for mt25qu512a
  mtd: spi-nor: micron-st: enable lock/unlock for mt25qu512a
  mtd: rawnand: Remove unused of_gpio.h inclusion
  mtd: spinand: Add support for XTX XT26xxxDxxxxx
  mtd: spinand: winbond: add support for serial NAND flash
  mtd: rawnand: cadence: Annotate struct cdns_nand_chip with __counted_by
  mtd: rawnand: Annotate struct mtk_nfc_nand_chip with __counted_by
  mtd: spinand: add support for FORESEE F35SQA002G
  mtd: rawnand: rockchip: Use struct_size()
  mtd: rawnand: arasan: Include ECC syndrome along with in-band data while checking for ECC failure
  mtd: Use device_get_match_data()
  mtd: spi-nor: nxp-spifi: Convert to platform remove callback returning void
  mtd: spi-nor: hisi-sfc: Convert to platform remove callback returning void
  mtd: maps: sun_uflash: Convert to platform remove callback returning void
  mtd: maps: sa1100-flash: Convert to platform remove callback returning void
  mtd: maps: pxa2xx-flash: Convert to platform remove callback returning void
  ...