linux/drivers/mtd, branch v6.16

mtd: nand: qpic_common: prevent out of bounds access of BAM arrays

2025-06-29T21:10:47Z

The common QPIC code does not do any boundary checking when it handles the command elements and scatter gater list arrays of a BAM transaction, thus it allows to access out of bounds elements in those. Although it is the responsibility of the given driver to allocate enough space for all possible BAM transaction variations, however there can be mistakes in the driver code which can lead to hidden memory corruption issues which are hard to debug. This kind of problem has been observed during testing the 'spi-qpic-snand' driver. Although the driver has been fixed with a preceding patch, but it still makes sense to reduce the chance of having such errors again later. In order to prevent such errors, change the qcom_alloc_bam_transaction() function to store the number of elements of the arrays in the 'bam_transaction' strucutre during allocation. Also, add sanity checks to the qcom_prep_bam_dma_desc_{cmd,data}() functions to avoid using out of bounds indices for the arrays. Tested-by: Lakshmi Sowjanya D # on SDX75 Acked-by: Miquel Raynal Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250618-qpic-snand-avoid-mem-corruption-v3-2-319c71296cda@gmail.com Signed-off-by: Mark Brown

mtd: spinand: fix memory leak of ECC engine conf

2025-06-19T17:13:21Z

Memory allocated for the ECC engine conf is not released during spinand cleanup. Below kmemleak trace is seen for this memory leak: unreferenced object 0xffffff80064f00e0 (size 8): comm "swapper/0", pid 1, jiffies 4294937458 hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleak_alloc+0x30/0x40 __kmalloc_cache_noprof+0x208/0x3c0 spinand_ondie_ecc_init_ctx+0x114/0x200 nand_ecc_init_ctx+0x70/0xa8 nanddev_ecc_engine_init+0xec/0x27c spinand_probe+0xa2c/0x1620 spi_mem_probe+0x130/0x21c spi_probe+0xf0/0x170 really_probe+0x17c/0x6e8 __driver_probe_device+0x17c/0x21c driver_probe_device+0x58/0x180 __device_attach_driver+0x15c/0x1f8 bus_for_each_drv+0xec/0x150 __device_attach+0x188/0x24c device_initial_probe+0x10/0x20 bus_probe_device+0x11c/0x160 Fix the leak by calling nanddev_ecc_engine_cleanup() inside spinand_cleanup(). Signed-off-by: Pablo Martin-Gomez Signed-off-by: Miquel Raynal

mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants

2025-06-18T09:18:45Z

Dual and quad capable chips natively support dual and quad I/O variants at up to 104MHz (1-2-2 and 1-4-4 operations). Reaching the maximum speed of 166MHz is theoretically possible (while still unsupported in the field) by adding a few more dummy cycles. Let's be accurate and clearly state this limit. Setting a maximum frequency implies adding the frequency parameter to the macro, which is done using a variadic argument to avoid impacting all the other drivers which already make use of this macro. Fixes: 1ea808b4d15b ("mtd: spinand: winbond: Update the *JW chip definitions") Signed-off-by: Miquel Raynal

mtd: spinand: winbond: Increase maximum frequency on an octal operation

2025-06-18T09:18:45Z

The default number of dummy cycles is 16 in octal I/O mode (1S-8S-8S), and with this default configuration the maximum frequency is higher than what is being advertised. There are higher and lower frequency possibilities, which involve making changes in the number of dummy cycles through the VCR register. At this stage, let's just describe the default configuration correctly. There should be no functional change. Fixes: 1ac5ff2f2ad6 ("mtd: spinand: winbond: Add octal support") Signed-off-by: Miquel Raynal

mtd: spinand: winbond: Fix W35N number of planes/LUN

2025-06-18T09:18:45Z

There's been a mistake when extracting the geometry of the W35N02 and W35N04 chips from the datasheet. There is a single plane, however there are respectively 2 and 4 LUNs. They are actually referred in the datasheet as dies (equivalent of target), but as there is no die select operation and the chips only feature a single configuration register for the entire chip (instead of one per die), we can reasonably assume we are talking about LUNs and not dies. Reported-by: Andreas Dannenberg Suggested-by: Vignesh Raghavendra Fixes: 25e08bf66660 ("mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal

Revert "mtd: core: always create master device"

2025-06-18T09:18:23Z

The idea behind this patch was to always let a "master" mtd device available to anchor runtime PM. Historically, there was no mtd device representing the whole storage as soon as partitions were coming into play. The introduction of CONFIG_MTD_PARTITIONED_MASTER allowed to keep this "master" device, but was not enabled by default to avoid breaking existing users (otherwise the mtd device numbering would be totally messed up with an off by 1, at least). The approach of adding an mtd_master class on top of partitioned mtd devices is breaking the mtd core in many creative ways, so better think again this approach and revert the faulty changes for now. This reverts commit 0aa7b390fc40a871267a2328bbbefca8b37ad307. Fixes: 0aa7b390fc40 ("mtd: core: always create master device") Tested-by: Guenter Roeck Acked-by: Guenter Roeck Signed-off-by: Miquel Raynal

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37Z

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

Merge tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2025-06-02T18:08:17Z

Pull MTD updates from Miquel Raynal: "A big core MTD change is the introduction of a new class to always register a master device. This is a problem that has been there forever: the "master" device was not always present depending on a number of heuristics such as the presence of fixed partitions and the absence of a Kconfig symbol to force its presence. This was a problem for runtime PM operations which might not have the "master" device available in all situation. The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Finally, Macornix SPI NOR entries have been cleaned-up and some SFDP table fixups for Macronix MX25L3255E have been merged. Aside from this, there is the usual load of misc improvement, fixes, and yaml conversion" * tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (42 commits) mtd: rawnand: brcmnand: legacy exec_op implementation mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk mtd: nand: brcmnand: fix NAND timeout when accessing eMMC mtd: nand: sunxi: Add randomizer configuration before randomizer enable mtd: spinand: esmt: fix id code for F50D1G41LB mtd: rawnand: brcmnand: remove unused parameters mtd: core: always create master device mtd: rawnand: loongson1: Fix inconsistent refcounting in ls1x_nand_chip_init() mtd: rawnand: loongson1: Fix error code in ls1x_nand_dma_transfer() mtd: rawnand: qcom: Fix read len for onfi param page mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() mtd: rawnand: qcom: Pass 18 bit offset from NANDc base to BAM base dt-bindings: mtd: qcom,nandc: Document the SDX75 NAND controller mtd: bcm47xxnflash: Add error handling for bcm47xxnflash_ops_bcm4706_ctl_cmd() mtd: rawnand: Use non-hybrid PCI devres API mtd: nand: ecc-mxic: Fix use of uninitialized variable ret mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips mtd: spinand: winbond: Add octal support mtd: spinand: winbond: Add support for W35N01JW in single mode mtd: spinand: winbond: Rename DTR variants ...

Merge tag 'nand/for-6.16' into mtd/next

2025-06-02T16:39:50Z

The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Aside from this, there is the usual load of misc improvement and fixes.

Merge tag 'spi-nor/for-6.16' into mtd/next

2025-06-02T16:39:35Z

SPI NOR changes for 6.16 Notable changes: - Cleanup some Macronix flash entries. - Add SFDP table fixups for Macronix MX25L3255E.