From 90936c3c790ec22b02c6d8611a9df0aecb8139bb Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Fri, 4 Sep 2026 18:22:03 +0530 Subject: mtd: fix typos in comments Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Miquel Raynal --- drivers/mtd/devices/docg3.c | 4 ++-- drivers/mtd/nand/onenand/onenand_base.c | 2 +- drivers/mtd/nand/raw/fsmc_nand.c | 2 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nand/raw/mtk_nand.c | 2 +- drivers/mtd/nand/raw/nand_base.c | 2 +- drivers/mtd/nand/raw/nand_legacy.c | 4 ++-- drivers/mtd/spi-nor/otp.c | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index 603fd0efc2ea..84566997d665 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -1884,7 +1884,7 @@ static void doc_release_device(struct mtd_info *mtd) /** * docg3_resume - Awakens docg3 floor - * @pdev: platfrom device + * @pdev: platform device * * Returns 0 (always successful) */ @@ -1963,7 +1963,7 @@ static int docg3_suspend(struct platform_device *pdev, pm_message_t state) * @pdev: platform device * * Probes for a G3 chip at the specified IO space in the platform data - * ressources. The floor 0 must be available. + * resources. The floor 0 must be available. * * Returns 0 on success, -ENOMEM, -ENXIO on error */ diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c index d08aeac86f9f..bca5a3bebd41 100644 --- a/drivers/mtd/nand/onenand/onenand_base.c +++ b/drivers/mtd/nand/onenand/onenand_base.c @@ -3279,7 +3279,7 @@ static void onenand_check_features(struct mtd_info *mtd) * * Now it has as following * KFM4G16Q4M has NOP 4 with version ID 0x0131 - * KFM4G16Q5M has NOP 1 with versoin ID 0x013e + * KFM4G16Q5M has NOP 1 with version ID 0x013e */ if ((this->version_id & 0xf) == 0xe) this->options |= ONENAND_HAS_NOP_1; diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c index b13b2b0c3f30..08ef4425559c 100644 --- a/drivers/mtd/nand/raw/fsmc_nand.c +++ b/drivers/mtd/nand/raw/fsmc_nand.c @@ -461,7 +461,7 @@ static int fsmc_correct_ecc1(struct nand_chip *chip, chip->ecc.size, sm_order); } -/* Count the number of 0's in buff upto a max of max_bits */ +/* Count the number of 0's in buff up to a max of max_bits */ static int count_written_bits(u8 *buff, int size, int max_bits) { int k, written_bits = 0; diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c index 527165ccc839..c61f3983a713 100644 --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c @@ -2271,7 +2271,7 @@ static int nand_boot_init(struct gpmi_nand_data *this) { nand_boot_set_geometry(this); - /* This is ROM arch-specific initilization before the BBT scanning. */ + /* This is ROM arch-specific initialization before the BBT scanning. */ if (GPMI_IS_MX23(this)) return mx23_boot_init(this); return 0; diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c index 21c7e1102746..c439b7814ebb 100644 --- a/drivers/mtd/nand/raw/mtk_nand.c +++ b/drivers/mtd/nand/raw/mtk_nand.c @@ -42,7 +42,7 @@ #define CON_BRD BIT(8) /* burst read */ #define CON_BWR BIT(9) /* burst write */ #define CON_SEC_SHIFT (12) -/* Timming control register */ +/* Timing control register */ #define NFI_ACCCON (0x0C) #define NFI_INTR_EN (0x10) #define INTR_AHB_DONE_EN BIT(6) diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c index a5b278ab9384..a225b10f8145 100644 --- a/drivers/mtd/nand/raw/nand_base.c +++ b/drivers/mtd/nand/raw/nand_base.c @@ -6205,7 +6205,7 @@ static int nand_scan_tail(struct nand_chip *chip) /* * FIXME: some NAND manufacturer drivers expect the first die to be * selected when manufacturer->init() is called. They should be fixed - * to explictly select the relevant die when interacting with the NAND + * to explicitly select the relevant die when interacting with the NAND * chip. */ nand_select_target(chip, 0); diff --git a/drivers/mtd/nand/raw/nand_legacy.c b/drivers/mtd/nand/raw/nand_legacy.c index 97700f80d5b8..94d5c7723c5a 100644 --- a/drivers/mtd/nand/raw/nand_legacy.c +++ b/drivers/mtd/nand/raw/nand_legacy.c @@ -319,7 +319,7 @@ static void nand_command(struct nand_chip *chip, unsigned int command, NAND_CTRL_CLE | NAND_CTRL_CHANGE); chip->legacy.cmd_ctrl(chip, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE); - /* EZ-NAND can take upto 250ms as per ONFi v4.0 */ + /* EZ-NAND can take up to 250ms as per ONFi v4.0 */ nand_wait_status_ready(chip, 250); return; @@ -459,7 +459,7 @@ static void nand_command_lp(struct nand_chip *chip, unsigned int command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); chip->legacy.cmd_ctrl(chip, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE); - /* EZ-NAND can take upto 250ms as per ONFi v4.0 */ + /* EZ-NAND can take up to 250ms as per ONFi v4.0 */ nand_wait_status_ready(chip, 250); return; diff --git a/drivers/mtd/spi-nor/otp.c b/drivers/mtd/spi-nor/otp.c index 7d0b145d78d8..61c55227e15d 100644 --- a/drivers/mtd/spi-nor/otp.c +++ b/drivers/mtd/spi-nor/otp.c @@ -25,7 +25,7 @@ * Read a security register by using the SPINOR_OP_RSECR commands. * * In Winbond/GigaDevice datasheets the term "security register" stands for - * an one-time-programmable memory area, consisting of multiple bytes (usually + * a one-time-programmable memory area, consisting of multiple bytes (usually * 256). Thus one "security register" maps to one OTP region. * * This method is used on GigaDevice and Winbond flashes. -- cgit v1.2.3 From 673f0a002d60701af888d2280543b7556c0c2b20 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Sun, 6 Sep 2026 17:48:21 -0700 Subject: mtd: powernv_flash: fix kernel-doc for powernv_flash_release The function is powernv_flash_release, not op_release. Update the kernel-doc comment to match. Fixes W=1 warning: Warning: drivers/mtd/devices/powernv_flash.c:271 expecting prototype for op_release(). Prototype was for powernv_flash_release() instead Assisted-by: Opencode:BigPickle Signed-off-by: Rosen Penev Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Miquel Raynal --- drivers/mtd/devices/powernv_flash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/devices/powernv_flash.c b/drivers/mtd/devices/powernv_flash.c index a12427d9e20f..fe1d6684d0bd 100644 --- a/drivers/mtd/devices/powernv_flash.c +++ b/drivers/mtd/devices/powernv_flash.c @@ -263,7 +263,7 @@ static int powernv_flash_probe(struct platform_device *pdev) } /** - * op_release - Release the driver + * powernv_flash_release - Release the driver * @pdev: the platform device * * Returns 0 -- cgit v1.2.3 From 8fcbb04ee5152b303980b2b48d69c6f7f4094ca6 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Sun, 6 Sep 2026 17:49:10 -0700 Subject: mtd: docg3: use devm_platform_ioremap_resource() Replace the open-coded platform_get_resource(IORESOURCE_MEM, 0) plus devm_ioremap() sequence with devm_platform_ioremap_resource(), which folds the resource lookup, region reservation and mapping into one step and returns an ERR_PTR checked with IS_ERR()/PTR_ERR(). The canonical docg3 register window is DOC_IOSPACE_SIZE (0x2000), which is the size any platform provides for this device, so mapping the full resource is equivalent to the previous fixed-size devm_ioremap(). Built for ARM (multi_v7_defconfig + CONFIG_MTD_DOCG3) with LLVM=1; drivers/mtd/devices/docg3.o compiles cleanly. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/devices/docg3.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index 84566997d665..3d89f810e2db 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -1971,25 +1971,15 @@ static int __init docg3_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; struct mtd_info *mtd; - struct resource *ress; void __iomem *base; int ret, floor; struct docg3_cascade *cascade; - ret = -ENXIO; - ress = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!ress) { - dev_err(dev, "No I/O memory resource defined\n"); - return ret; - } + base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(base)) + return PTR_ERR(base); ret = -ENOMEM; - base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE); - if (!base) { - dev_err(dev, "devm_ioremap dev failed\n"); - return ret; - } - cascade = devm_kcalloc(dev, DOC_MAX_NBFLOORS, sizeof(*cascade), GFP_KERNEL); if (!cascade) -- cgit v1.2.3 From 3be16e5d4990bf96309ac5ba35cb369c6015bce7 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Mon, 14 Sep 2026 21:06:47 -0400 Subject: mtd: maps: pci: balance PCI enable on cleanup mtd_pci_probe() leaves the PCI device enabled on later probe failure and mtd_pci_remove() does not disable it either. Use pcim_enable_device() to release the enable reference after the existing map and region cleanup. The imbalance is already present in the initial Git import. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Signed-off-by: Miquel Raynal --- drivers/mtd/maps/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/maps/pci.c b/drivers/mtd/maps/pci.c index 34041cc8f173..f13a1f520d04 100644 --- a/drivers/mtd/maps/pci.c +++ b/drivers/mtd/maps/pci.c @@ -250,7 +250,7 @@ static int mtd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) struct mtd_info *mtd = NULL; int err; - err = pci_enable_device(dev); + err = pcim_enable_device(dev); if (err) goto out; -- cgit v1.2.3 From cfc5ebc9540e29f8f96db88bbfa261139e5afedb Mon Sep 17 00:00:00 2001 From: Orgad Shaneh Date: Wed, 16 Sep 2026 16:27:31 +0000 Subject: mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device The Write to Buffer command takes the number of words to program minus one, and do_write_buffer() sends that count as a single bus word: map_write(map, CMD(words - 1), cmd_adr); CMD() replicates the value into every device lane, so each device reads the count off its own data lines - eight of them on an x8 part. A count that does not fit in eight bits is truncated there, which limits one Write to Buffer to 256 words on an x8 device, however large a buffer the chip advertises in its CFI query. The M29EW on a Cavium Octeon CN6335 board (an x16 part strapped to x8) advertises MaxBufWriteSize = 512 bytes, so cfi_amdstd_write_buffers() split the data into 512-byte chunks and do_write_buffer() sent a count of 511. The chip saw 511 & 0xff = 255, expected 256 bytes, and aborted the program when the 257th arrived. Chunks below 256 bytes - the leading partial chunk of a write - completed normally, so only the full-size ones failed: MTD do_write_buffer_wait(): software timeout, address:0x03278bff. jffs2: Write of 4164 bytes at 0x02c789b4 failed. returned -5, retlen 68 jffs2: No space for garbage collection. Aborting GC thread Clamp MaxBufWriteSize for x8 devices in the write-buffer fixup, and recompute mtd->writebufsize, which cfi_cmdset_0002_setup() derives from MaxBufWriteSize before the fixups run. The clamp deliberately keys off the device width rather than the part, even though the driver already recognises this one in is_m29ew(): the ceiling comes from the width of a device's data bus, not from the chip, so any x8 device advertising a larger buffer is told a count it cannot receive. The M29EW is only where it was found. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Orgad Shaneh Signed-off-by: Miquel Raynal --- drivers/mtd/chips/cfi_cmdset_0002.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'drivers') diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c index 517db2f2707f..100cab95a17b 100644 --- a/drivers/mtd/chips/cfi_cmdset_0002.c +++ b/drivers/mtd/chips/cfi_cmdset_0002.c @@ -283,6 +283,21 @@ static void fixup_use_write_buffers(struct mtd_info *mtd) pr_debug("Using buffer write method\n"); mtd->_write = cfi_amdstd_write_buffers; } + + /* + * The word count of the Write to Buffer command is a single bus + * word per device, so an x8 device can be told to program at most + * 256 bytes however large a buffer it advertises - including when + * several of them are interleaved on a wider bus, where CMD() + * replicates the count into each device's lane and it is truncated + * there. + */ + if (cfi->device_type == CFI_DEVICETYPE_X8 && + cfi->cfiq->MaxBufWriteSize > 8) { + cfi->cfiq->MaxBufWriteSize = 8; + mtd->writebufsize = cfi_interleave(cfi) << + cfi->cfiq->MaxBufWriteSize; + } } #endif /* !FORCE_WORD_WRITE */ -- cgit v1.2.3 From 1a122f5fecbabd47b81b1be3f0934f57b78aad42 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:20:51 +0000 Subject: mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() init_amd76xrom() obtains the PCI device with pci_get_device() and hands the reference over to amd76xrom_init_one(), which stores it in window->pdev. When reserving the ROM window fails, that function returns -EBUSY directly instead of going through amd76xrom_cleanup(), so the reference is neither released nor cleared. Drop the reference and clear window->pdev on that path. Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Miquel Raynal --- drivers/mtd/maps/amd76xrom.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers') diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c index 457e6ab7f3fb..0c3e0eb08b8d 100644 --- a/drivers/mtd/maps/amd76xrom.c +++ b/drivers/mtd/maps/amd76xrom.c @@ -152,6 +152,8 @@ static int amd76xrom_init_one(struct pci_dev *pdev, printk(KERN_ERR MOD_NAME " %s(): Unable to register resource %pR - kernel bug?\n", __func__, &window->rsrc); + pci_dev_put(window->pdev); + window->pdev = NULL; return -EBUSY; } -- cgit v1.2.3 From 521ad948e04934b2d70ae899bc016bbb38802e90 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:22:44 +0000 Subject: mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() init_l440gx() takes a single reference on the PIIX4 ISA bridge with pci_get_device() and drops it again right after the lookups, before the flash window is set up. The pci_assign_resource() failure path then calls pci_dev_put() on the same device a second time, releasing a reference that is no longer owned and underflowing the reference count. Remove the extra pci_dev_put(). Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Miquel Raynal --- drivers/mtd/maps/l440gx.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c index 832b880d1aaf..85cd273ce065 100644 --- a/drivers/mtd/maps/l440gx.c +++ b/drivers/mtd/maps/l440gx.c @@ -110,7 +110,6 @@ static int __init init_l440gx(void) /* Allocate the resource region */ if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) { - pci_dev_put(dev); pci_dev_put(pm_dev); printk(KERN_WARNING "Could not allocate pm iobase resource\n"); iounmap(l440gx_map.virt); -- cgit v1.2.3 From e6ca524ee5b2705be30ea19ce2e55122d9f9ed8f Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:24:07 +0000 Subject: mtd: maps: l440gx: Fix double put of the PM device in init_l440gx() The PIIX4 PM device reference taken with pci_get_device() is dropped again before the iobase resource is allocated. If pci_assign_resource() fails, the error path calls pci_dev_put() on pm_dev a second time, releasing a reference that is no longer owned and underflowing the reference count. Remove the extra pci_dev_put(). Fixes: dd8e9ed6ed54 ("[MTD] Switch to pci_get_device and do ref counting") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Miquel Raynal --- drivers/mtd/maps/l440gx.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/maps/l440gx.c b/drivers/mtd/maps/l440gx.c index 85cd273ce065..1df5ea5fafca 100644 --- a/drivers/mtd/maps/l440gx.c +++ b/drivers/mtd/maps/l440gx.c @@ -110,7 +110,6 @@ static int __init init_l440gx(void) /* Allocate the resource region */ if (pci_assign_resource(pm_dev, PIIXE_IOBASE_RESOURCE) != 0) { - pci_dev_put(pm_dev); printk(KERN_WARNING "Could not allocate pm iobase resource\n"); iounmap(l440gx_map.virt); return -ENXIO; -- cgit v1.2.3 From 62ee3da38f41bef83c1cf250f6816a0ee187674b Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:25:50 +0000 Subject: mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() mtd_get_sb() is called with a reference to the MTD device already taken by the caller. When sget_dev() fails, the function returns the error without dropping that reference, so the device is never released and its refcount never reaches zero. Every mount attempt on an MTD device whose superblock cannot be set up leaks a reference. Restore the put_mtd_device() that the fs_context conversion dropped on this path. Fixes: 0f071004109d ("mtd: Provide fs_context-aware mount_mtd() replacement") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Miquel Raynal --- drivers/mtd/mtdsuper.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c index c709ff7aa6b5..02eede3fe582 100644 --- a/drivers/mtd/mtdsuper.c +++ b/drivers/mtd/mtdsuper.c @@ -31,8 +31,10 @@ static int mtd_get_sb(struct fs_context *fc, int ret; sb = sget_dev(fc, MKDEV(MTD_BLOCK_MAJOR, mtd->index)); - if (IS_ERR(sb)) + if (IS_ERR(sb)) { + put_mtd_device(mtd); return PTR_ERR(sb); + } if (sb->s_root) { /* new mountpoint for an already mounted superblock */ -- cgit v1.2.3 From 904f18430e8cce829cb9130eab7a93020e33fc89 Mon Sep 17 00:00:00 2001 From: Richard Weinberger Date: Thu, 17 Sep 2026 16:53:29 +0200 Subject: mtd: Call get_wunit() on the master partition The code checks whether master has get_wunit() but still calls it on the child. Fix this. Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling") Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger Signed-off-by: Miquel Raynal --- drivers/mtd/mtdcore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 16629382a787..82b1e6392b16 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -563,7 +563,7 @@ int mtd_pairing_info_to_wunit(struct mtd_info *mtd, return -EINVAL; if (master->pairing && master->pairing->get_wunit) - return mtd->pairing->get_wunit(master, info); + return master->pairing->get_wunit(master, info); return info->pair; } -- cgit v1.2.3 From a018524a2ec96da5bb1965053967a20e0069ed9e Mon Sep 17 00:00:00 2001 From: Frank Li Date: Thu, 17 Sep 2026 16:47:06 -0400 Subject: mtd: use dmaengine_get_dma_device() instead of chan->device->dev Replace direct dma_chan::device::dev access with the proper dmaengine_get_dma_device() for consumer API. chan->device->dev is not always the device used for DMA mapping. Some DMA engines support per-channel IOMMU mappings, so different channels may use different DMA devices. dmaengine_get_dma_device() returns the correct device for each channel. This also prepares for making the DMA engine provider data structures private. DMA consumers should not access DMA engine internals directly. Assisted-by: LLM Signed-off-by: Frank Li Signed-off-by: Miquel Raynal --- drivers/mtd/hyperbus/hbmc-am654.c | 7 ++++--- drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +- drivers/mtd/nand/raw/intel-nand-controller.c | 6 ++++-- drivers/mtd/nand/raw/loongson-nand-controller.c | 4 ++-- drivers/mtd/nand/raw/lpc32xx_mlc.c | 10 ++++------ drivers/mtd/nand/raw/lpc32xx_slc.c | 10 ++++------ drivers/mtd/nand/raw/marvell_nand.c | 7 ++++--- drivers/mtd/nand/raw/omap2.c | 10 +++++----- drivers/mtd/nand/raw/sh_flctl.c | 8 +++++--- 9 files changed, 33 insertions(+), 31 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c index 9d31464046b2..8a14e908d0b5 100644 --- a/drivers/mtd/hyperbus/hbmc-am654.c +++ b/drivers/mtd/hyperbus/hbmc-am654.c @@ -78,14 +78,15 @@ static int am654_hbmc_dma_read(struct am654_hbmc_device_priv *priv, void *to, struct dma_chan *rx_chan = priv->rx_chan; struct dma_async_tx_descriptor *tx; dma_addr_t dma_dst, dma_src; + struct device *rx_dev = dmaengine_get_dma_device(rx_chan); dma_cookie_t cookie; int ret; if (!priv->rx_chan || !virt_addr_valid(to) || object_is_on_stack(to)) return -EINVAL; - dma_dst = dma_map_single(rx_chan->device->dev, to, len, DMA_FROM_DEVICE); - if (dma_mapping_error(rx_chan->device->dev, dma_dst)) { + dma_dst = dma_map_single(rx_dev, to, len, DMA_FROM_DEVICE); + if (dma_mapping_error(rx_dev, dma_dst)) { dev_dbg(priv->ctlr->dev, "DMA mapping failed\n"); return -EIO; } @@ -117,7 +118,7 @@ static int am654_hbmc_dma_read(struct am654_hbmc_device_priv *priv, void *to, } unmap_dma: - dma_unmap_single(rx_chan->device->dev, dma_dst, len, DMA_FROM_DEVICE); + dma_unmap_single(rx_dev, dma_dst, len, DMA_FROM_DEVICE); return ret; } diff --git a/drivers/mtd/nand/raw/cadence-nand-controller.c b/drivers/mtd/nand/raw/cadence-nand-controller.c index d53b35a8b3cb..88f22fa4704e 100644 --- a/drivers/mtd/nand/raw/cadence-nand-controller.c +++ b/drivers/mtd/nand/raw/cadence-nand-controller.c @@ -3229,7 +3229,7 @@ static void cadence_nand_remove(struct cdns_nand_ctrl *cdns_ctrl) { cadence_nand_chips_cleanup(cdns_ctrl); if (cdns_ctrl->dmac) - dma_unmap_resource(cdns_ctrl->dmac->device->dev, + dma_unmap_resource(dmaengine_get_dma_device(cdns_ctrl->dmac), cdns_ctrl->io.iova_dma, cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0); cadence_nand_irq_cleanup(cdns_ctrl->irq, cdns_ctrl); diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c index 01cefdaf115d..0a4f5ff11133 100644 --- a/drivers/mtd/nand/raw/intel-nand-controller.c +++ b/drivers/mtd/nand/raw/intel-nand-controller.c @@ -290,6 +290,7 @@ static int ebu_dma_start(struct ebu_nand_controller *ebu_host, u32 dir, struct dma_async_tx_descriptor *tx; struct completion *dma_completion; dma_async_tx_callback callback; + struct device *dma_dev; struct dma_chan *chan; dma_cookie_t cookie; unsigned long flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; @@ -307,8 +308,9 @@ static int ebu_dma_start(struct ebu_nand_controller *ebu_host, u32 dir, callback = ebu_dma_tx_callback; } - buf_dma = dma_map_single(chan->device->dev, (void *)buf, len, dir); - if (dma_mapping_error(chan->device->dev, buf_dma)) { + dma_dev = dmaengine_get_dma_device(chan); + buf_dma = dma_map_single(dma_dev, (void *)buf, len, dir); + if (dma_mapping_error(dma_dev, buf_dma)) { dev_err(ebu_host->dev, "Failed to map DMA buffer\n"); ret = -EIO; goto err_unmap; diff --git a/drivers/mtd/nand/raw/loongson-nand-controller.c b/drivers/mtd/nand/raw/loongson-nand-controller.c index 8490412d5be1..935f66602de9 100644 --- a/drivers/mtd/nand/raw/loongson-nand-controller.c +++ b/drivers/mtd/nand/raw/loongson-nand-controller.c @@ -391,7 +391,7 @@ static void loongson_nand_dma_callback(void *data) { struct loongson_nand_host *host = (struct loongson_nand_host *)data; struct dma_chan *chan = host->dma_chan; - struct device *dev = chan->device->dev; + struct device *dev = dmaengine_get_dma_device(chan); enum dma_status status; status = dmaengine_tx_status(chan, host->dma_cookie, NULL); @@ -407,7 +407,7 @@ static int loongson_nand_dma_transfer(struct loongson_nand_host *host, struct lo { struct nand_chip *chip = &host->chip; struct dma_chan *chan = host->dma_chan; - struct device *dev = chan->device->dev; + struct device *dev = dmaengine_get_dma_device(chan); struct dma_async_tx_descriptor *desc; enum dma_data_direction data_dir = op->is_write ? DMA_TO_DEVICE : DMA_FROM_DEVICE; enum dma_transfer_direction xfer_dir = op->is_write ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM; diff --git a/drivers/mtd/nand/raw/lpc32xx_mlc.c b/drivers/mtd/nand/raw/lpc32xx_mlc.c index 8f6a89d9ba83..4400989df8a0 100644 --- a/drivers/mtd/nand/raw/lpc32xx_mlc.c +++ b/drivers/mtd/nand/raw/lpc32xx_mlc.c @@ -394,6 +394,7 @@ static int lpc32xx_xmit_dma(struct mtd_info *mtd, void *mem, int len, { struct nand_chip *chip = mtd_to_nand(mtd); struct lpc32xx_nand_host *host = nand_get_controller_data(chip); + struct device *dma_dev = dmaengine_get_dma_device(host->dma_chan); struct dma_async_tx_descriptor *desc; int flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; unsigned long time_left; @@ -401,8 +402,7 @@ static int lpc32xx_xmit_dma(struct mtd_info *mtd, void *mem, int len, sg_init_one(&host->sgl, mem, len); - res = dma_map_sg(host->dma_chan->device->dev, &host->sgl, 1, - DMA_BIDIRECTIONAL); + res = dma_map_sg(dma_dev, &host->sgl, 1, DMA_BIDIRECTIONAL); if (res != 1) { dev_err(mtd->dev.parent, "Failed to map sg list\n"); return -ENXIO; @@ -430,12 +430,10 @@ static int lpc32xx_xmit_dma(struct mtd_info *mtd, void *mem, int len, goto out1; } - dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1, - DMA_BIDIRECTIONAL); + dma_unmap_sg(dma_dev, &host->sgl, 1, DMA_BIDIRECTIONAL); return 0; out1: - dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1, - DMA_BIDIRECTIONAL); + dma_unmap_sg(dma_dev, &host->sgl, 1, DMA_BIDIRECTIONAL); return res; } diff --git a/drivers/mtd/nand/raw/lpc32xx_slc.c b/drivers/mtd/nand/raw/lpc32xx_slc.c index 10c8080207f4..bdc3957369c2 100644 --- a/drivers/mtd/nand/raw/lpc32xx_slc.c +++ b/drivers/mtd/nand/raw/lpc32xx_slc.c @@ -427,6 +427,7 @@ static int lpc32xx_xmit_dma(struct mtd_info *mtd, dma_addr_t dma, { struct nand_chip *chip = mtd_to_nand(mtd); struct lpc32xx_nand_host *host = nand_get_controller_data(chip); + struct device *dma_dev = dmaengine_get_dma_device(host->dma_chan); struct dma_async_tx_descriptor *desc; int flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; int res; @@ -448,8 +449,7 @@ static int lpc32xx_xmit_dma(struct mtd_info *mtd, dma_addr_t dma, sg_init_one(&host->sgl, mem, len); - res = dma_map_sg(host->dma_chan->device->dev, &host->sgl, 1, - DMA_BIDIRECTIONAL); + res = dma_map_sg(dma_dev, &host->sgl, 1, DMA_BIDIRECTIONAL); if (res != 1) { dev_err(mtd->dev.parent, "Failed to map sg list\n"); return -ENXIO; @@ -477,13 +477,11 @@ static int lpc32xx_xmit_dma(struct mtd_info *mtd, dma_addr_t dma, res = 0; } - dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1, - DMA_BIDIRECTIONAL); + dma_unmap_sg(dma_dev, &host->sgl, 1, DMA_BIDIRECTIONAL); return res; out1: - dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1, - DMA_BIDIRECTIONAL); + dma_unmap_sg(dma_dev, &host->sgl, 1, DMA_BIDIRECTIONAL); return -ENXIO; } diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c index 38b7eb5b992c..e5fa5540e80a 100644 --- a/drivers/mtd/nand/raw/marvell_nand.c +++ b/drivers/mtd/nand/raw/marvell_nand.c @@ -868,6 +868,7 @@ static int marvell_nfc_xfer_data_dma(struct marvell_nfc *nfc, unsigned int len) { unsigned int dma_len = min_t(int, ALIGN(len, 32), MAX_CHUNK_SIZE); + struct device *dma_dev = dmaengine_get_dma_device(nfc->dma_chan); struct dma_async_tx_descriptor *tx; struct scatterlist sg; dma_cookie_t cookie; @@ -876,7 +877,7 @@ static int marvell_nfc_xfer_data_dma(struct marvell_nfc *nfc, marvell_nfc_enable_dma(nfc); /* Prepare the DMA transfer */ sg_init_one(&sg, nfc->dma_buf, dma_len); - ret = dma_map_sg(nfc->dma_chan->device->dev, &sg, 1, direction); + ret = dma_map_sg(dma_dev, &sg, 1, direction); if (!ret) { dev_err(nfc->dev, "Could not map DMA S/G list\n"); return -ENXIO; @@ -888,7 +889,7 @@ static int marvell_nfc_xfer_data_dma(struct marvell_nfc *nfc, DMA_PREP_INTERRUPT); if (!tx) { dev_err(nfc->dev, "Could not prepare DMA S/G list\n"); - dma_unmap_sg(nfc->dma_chan->device->dev, &sg, 1, direction); + dma_unmap_sg(dma_dev, &sg, 1, direction); return -ENXIO; } @@ -900,7 +901,7 @@ static int marvell_nfc_xfer_data_dma(struct marvell_nfc *nfc, dma_async_issue_pending(nfc->dma_chan); ret = marvell_nfc_wait_cmdd(nfc->selected_chip); - dma_unmap_sg(nfc->dma_chan->device->dev, &sg, 1, direction); + dma_unmap_sg(dma_dev, &sg, 1, direction); marvell_nfc_disable_dma(nfc); if (ret) { dev_err(nfc->dev, "Timeout waiting for DMA (status: %d)\n", diff --git a/drivers/mtd/nand/raw/omap2.c b/drivers/mtd/nand/raw/omap2.c index 552f36da79fc..9f7079e36663 100644 --- a/drivers/mtd/nand/raw/omap2.c +++ b/drivers/mtd/nand/raw/omap2.c @@ -380,8 +380,8 @@ static inline int omap_nand_dma_transfer(struct nand_chip *chip, { struct omap_nand_info *info = mtd_to_omap(nand_to_mtd(chip)); struct dma_async_tx_descriptor *tx; - enum dma_data_direction dir = is_write ? DMA_TO_DEVICE : - DMA_FROM_DEVICE; + enum dma_data_direction dir = is_write ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + struct device *dma_dev = dmaengine_get_dma_device(info->dma); struct scatterlist sg; unsigned long tim, limit; unsigned n; @@ -392,7 +392,7 @@ static inline int omap_nand_dma_transfer(struct nand_chip *chip, goto out_copy; sg_init_one(&sg, addr, len); - n = dma_map_sg(info->dma->device->dev, &sg, 1, dir); + n = dma_map_sg(dma_dev, &sg, 1, dir); if (n == 0) { dev_err(&info->pdev->dev, "Couldn't DMA map a %d byte buffer\n", len); @@ -434,11 +434,11 @@ static inline int omap_nand_dma_transfer(struct nand_chip *chip, /* disable and stop the PFPW engine */ omap_prefetch_reset(info->gpmc_cs, info); - dma_unmap_sg(info->dma->device->dev, &sg, 1, dir); + dma_unmap_sg(dma_dev, &sg, 1, dir); return 0; out_copy_unmap: - dma_unmap_sg(info->dma->device->dev, &sg, 1, dir); + dma_unmap_sg(dma_dev, &sg, 1, dir); out_copy: is_write == 0 ? omap_nand_data_in(chip, (void *)addr, len, false) : omap_nand_data_out(chip, addr, len, false); diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flctl.c index 97f733e481ff..0497801d7059 100644 --- a/drivers/mtd/nand/raw/sh_flctl.c +++ b/drivers/mtd/nand/raw/sh_flctl.c @@ -378,6 +378,7 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, int len, enum dma_data_direction dir) { struct dma_async_tx_descriptor *desc = NULL; + struct device *dma_dev; struct dma_chan *chan; enum dma_transfer_direction tr_dir; dma_addr_t dma_addr; @@ -394,9 +395,10 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, tr_dir = DMA_MEM_TO_DEV; } - dma_addr = dma_map_single(chan->device->dev, buf, len, dir); + dma_dev = dmaengine_get_dma_device(chan); + dma_addr = dma_map_single(dma_dev, buf, len, dir); - if (!dma_mapping_error(chan->device->dev, dma_addr)) + if (!dma_mapping_error(dma_dev, dma_addr)) desc = dmaengine_prep_slave_single(chan, dma_addr, len, tr_dir, DMA_PREP_INTERRUPT | DMA_CTRL_ACK); @@ -440,7 +442,7 @@ out: reg &= ~DREQ0EN; writel(reg, FLINTDMACR(flctl)); - dma_unmap_single(chan->device->dev, dma_addr, len, dir); + dma_unmap_single(dma_dev, dma_addr, len, dir); /* ret == 0 is success */ return ret; -- cgit v1.2.3 From 30c70e01f79f04b802821d6de24a6480538e3909 Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Sat, 19 Sep 2026 21:08:06 +0800 Subject: mtd: cfi_cmdset_0001: use assign_bit() where applicable Convert open-coded if/else with set_bit/clear_bit to the assign_bit API. Signed-off-by: Peng Fan Reviewed-by: Breno Leitao Signed-off-by: Miquel Raynal --- drivers/mtd/chips/cfi_cmdset_0001.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c index 6049ba2d6bcb..dff29347ef40 100644 --- a/drivers/mtd/chips/cfi_cmdset_0001.c +++ b/drivers/mtd/chips/cfi_cmdset_0001.c @@ -2510,10 +2510,7 @@ static void cfi_intelext_save_locks(struct mtd_info *mtd) status = cfi_varsize_frob(mtd, do_getlockstatus_oneblock, adr, len, NULL); - if (status) - set_bit(block, region->lockmap); - else - clear_bit(block, region->lockmap); + assign_bit(block, region->lockmap, status); } } } -- cgit v1.2.3 From d498b2ddda99eed28cde177b1620dbcea246a1c4 Mon Sep 17 00:00:00 2001 From: Qingfang Deng Date: Mon, 21 Sep 2026 09:49:20 +0800 Subject: mtd: block: prevent reclaim I/O during request processing The blktrans request callbacks run under dev->lock and may allocate memory with GFP_KERNEL. For example, mtdblock_writesect() uses vmalloc() to allocate its eraseblock cache. Direct reclaim can then recurse into block I/O and deadlock on resources held by the request being processed. syzbot reports a circular locking dependency involving the device mutex and fs_reclaim. Commit d5ba1c8ffd0b ("mtd: don't use PF_MEMALLOC") removed PF_MEMALLOC from the MTD request thread. That flag had prevented direct reclaim, so its removal made allocations during request processing eligible for reclaim without excluding I/O. Wrap request processing in mtd_queue_rq() in a NOIO scope. This covers both the request and background callbacks, including allocations made by lower MTD drivers, and prevents reclaim from initiating filesystem or block I/O. Fixes: d5ba1c8ffd0b ("mtd: don't use PF_MEMALLOC") Assisted-by: Codex:gpt-6-astra Reported-by: syzbot+e08e0a15269eefa87790@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e08e0a15269eefa87790 Signed-off-by: Qingfang Deng Signed-off-by: Miquel Raynal --- drivers/mtd/mtd_blkdevs.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'drivers') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 4d2e7b7774e9..42f250344f0c 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include "mtdcore.h" @@ -167,6 +168,7 @@ static blk_status_t mtd_queue_rq(struct blk_mq_hw_ctx *hctx, const struct blk_mq_queue_data *bd) { struct mtd_blktrans_dev *dev; + unsigned int noio_flags; dev = hctx->queue->queuedata; if (!dev) { @@ -174,10 +176,13 @@ static blk_status_t mtd_queue_rq(struct blk_mq_hw_ctx *hctx, return BLK_STS_IOERR; } + /* Reclaim must not recurse into I/O while processing requests. */ + noio_flags = memalloc_noio_save(); spin_lock_irq(&dev->queue_lock); list_add_tail(&bd->rq->queuelist, &dev->rq_list); mtd_blktrans_work(dev); spin_unlock_irq(&dev->queue_lock); + memalloc_noio_restore(noio_flags); return BLK_STS_OK; } -- cgit v1.2.3 From c4f64a86a28d218f3b16cd7b18691993aa60db60 Mon Sep 17 00:00:00 2001 From: Stephen Bancroft Date: Wed, 23 Sep 2026 19:26:24 +1000 Subject: mtd: maps: add INT0800 firmware-flash map driver Add a read-only mapping driver that binds the ACPI INT0800 "Intel 82802 firmware hub" device and exposes the system firmware flash as an MTD ROM device. On x86 machines the boot flash is decoded into the physical address space below 4 GB, so a plain ioremap() of the declared resource window is sufficient for reads - no SPI or LPC controller access is needed. The window may be larger than the real flash; undecoded holes read as 0xff. This gives userspace a clean, safe way to read firmware flash contents without flashrom or relaxed /dev/mem access - for firmware analysis, and for extracting option ROMs stored inside EFI firmware volumes (e.g. the NVIDIA VBIOS on EFI-booted Apple machines, which can then be fed to nouveau via nouveau.config=NvBios=). There is deliberately no write or erase support. Tested on a MacBookPro4,1 (ICH8M): /dev/mtd0 reads are byte-identical to a flashrom dump of the 2 MiB SST25VF016B, except for live NVRAM variable-store regions. Signed-off-by: Stephen Bancroft Signed-off-by: Miquel Raynal --- drivers/mtd/maps/Kconfig | 17 +++++++ drivers/mtd/maps/Makefile | 1 + drivers/mtd/maps/int0800.c | 115 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 133 insertions(+) create mode 100644 drivers/mtd/maps/int0800.c (limited to 'drivers') diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig index 1bb3dba2631d..649fd145e15d 100644 --- a/drivers/mtd/maps/Kconfig +++ b/drivers/mtd/maps/Kconfig @@ -161,6 +161,23 @@ config MTD_AMD76XROM BE VERY CAREFUL. +config MTD_INT0800 + tristate "Read-only BIOS/firmware flash via ACPI INT0800" + depends on X86 && ACPI + select MTD_ROM + help + Support for reading the system firmware (BIOS/EFI) flash chip + through the memory window described by the ACPI INT0800 + "82802 firmware hub" device, present on most x86 machines. + + The flash is exposed read-only via the ROM chip driver, e.g. + for firmware analysis or extracting option ROMs (such as + video BIOS images embedded in EFI firmware volumes). There is + no write or erase support. + + To compile this driver as a module, choose M here: the + module will be called int0800. + config MTD_ICHXROM tristate "BIOS flash chip on Intel Controller Hub 2/3/4/5" depends on X86 && MTD_JEDECPROBE diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile index 01745eca1f73..2f1a7375e13c 100644 --- a/drivers/mtd/maps/Makefile +++ b/drivers/mtd/maps/Makefile @@ -14,6 +14,7 @@ obj-$(CONFIG_MTD_L440GX) += l440gx.o obj-$(CONFIG_MTD_AMD76XROM) += amd76xrom.o obj-$(CONFIG_MTD_ESB2ROM) += esb2rom.o obj-$(CONFIG_MTD_ICHXROM) += ichxrom.o +obj-$(CONFIG_MTD_INT0800) += int0800.o obj-$(CONFIG_MTD_CK804XROM) += ck804xrom.o obj-$(CONFIG_MTD_TSUNAMI) += tsunami_flash.o obj-$(CONFIG_MTD_PXA2XX) += pxa2xx-flash.o diff --git a/drivers/mtd/maps/int0800.c b/drivers/mtd/maps/int0800.c new file mode 100644 index 000000000000..c5f108aa3479 --- /dev/null +++ b/drivers/mtd/maps/int0800.c @@ -0,0 +1,115 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Read-only MTD access to the system firmware flash behind the ACPI + * INT0800 "Intel 82802 firmware hub" device. + * + * On x86 systems the boot flash is decoded into the physical address + * space below 4 GB, so a plain ioremap() is sufficient to read it - + * no SPI or LPC controller access is required. The declared _CRS + * window may be larger than the real flash (the whole top-16MiB + * decode range is commonly claimed); undecoded holes read as 0xff. + * + * The device is exposed read-only via the ROM chip driver; there is + * deliberately no write or erase support. + */ + +#include +#include +#include +#include +#include +#include +#include + +/* top-of-4GB firmware decode, used when _CRS reports no window */ +#define INT0800_DEFAULT_PHYS 0xffe00000UL +#define INT0800_DEFAULT_SIZE SZ_2M + +struct int0800 { + struct map_info map; + struct mtd_info *mtd; +}; + +static int int0800_probe(struct platform_device *pdev) +{ + struct resource *res; + struct int0800 *fw; + resource_size_t end; + int ret; + + fw = devm_kzalloc(&pdev->dev, sizeof(*fw), GFP_KERNEL); + if (!fw) + return -ENOMEM; + + fw->map.name = dev_name(&pdev->dev); + fw->map.bankwidth = 1; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res) { + fw->map.phys = res->start; + fw->map.size = resource_size(res); + } else { + fw->map.phys = INT0800_DEFAULT_PHYS; + fw->map.size = INT0800_DEFAULT_SIZE; + } + + /* + * Plain ioremap on purpose: the window is already claimed by the + * ACPI/pnp resource reservation, so devm_ioremap_resource() would + * fail with -EBUSY. + */ + fw->map.virt = devm_ioremap(&pdev->dev, fw->map.phys, fw->map.size); + if (!fw->map.virt) + return -ENOMEM; + + simple_map_init(&fw->map); + fw->mtd = do_map_probe("map_rom", &fw->map); + if (!fw->mtd) + return -ENODEV; + fw->mtd->dev.parent = &pdev->dev; + platform_set_drvdata(pdev, fw); + + end = fw->map.phys + fw->map.size - 1; + dev_info(&pdev->dev, "mapped firmware window %pa-%pa\n", + &fw->map.phys, &end); + + ret = mtd_device_register(fw->mtd, NULL, 0); + if (ret) + map_destroy(fw->mtd); + return ret; +} + +static void int0800_remove(struct platform_device *pdev) +{ + struct int0800 *fw = platform_get_drvdata(pdev); + + mtd_device_unregister(fw->mtd); + map_destroy(fw->mtd); +} + +static const struct acpi_device_id int0800_ids[] = { + { "INT0800", 0 }, + { } +}; +MODULE_DEVICE_TABLE(acpi, int0800_ids); + +static struct platform_driver int0800_driver = { + .probe = int0800_probe, + .remove = int0800_remove, + .driver = { + .name = "int0800", + .acpi_match_table = int0800_ids, + /* + * remove() frees the mtd_info and unmaps the window even + * while /dev/mtdX fds are still open; the only safe + * teardown path is module unload, which open fds block + * via mtd->owner. + */ + .suppress_bind_attrs = true, + }, +}; +module_platform_driver(int0800_driver); + +MODULE_AUTHOR("Stephen Bancroft "); +MODULE_DESCRIPTION("Read-only MTD map over the INT0800 firmware flash window"); +MODULE_LICENSE("GPL"); -- cgit v1.2.3 From 2e566a6830b82d95837c4d669c63a0c1abf766a9 Mon Sep 17 00:00:00 2001 From: Harshit Mogalapalli Date: Thu, 24 Sep 2026 14:14:11 -0700 Subject: mtd: concat: use container_of_const() in CONCAT() CONCAT() currently recovers the enclosing struct mtd_concat by casting its embedded struct mtd_info pointer. This assumes mtd remains the first member of the structure. Use container_of_const() with the named member to make the relationship explicit and preserve any const qualifier. Suggested-by: Luca Ceresoli Signed-off-by: Harshit Mogalapalli Signed-off-by: Miquel Raynal --- drivers/mtd/mtdconcat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c index c97167d51fe2..1585d31a507d 100644 --- a/drivers/mtd/mtdconcat.c +++ b/drivers/mtd/mtdconcat.c @@ -31,7 +31,7 @@ * Given a pointer to the MTD object in the mtd_concat structure, * we can retrieve the pointer to that structure with this macro. */ -#define CONCAT(x) ((struct mtd_concat *)(x)) +#define CONCAT(x) container_of_const(x, struct mtd_concat, mtd) /* * MTD methods which look up the relevant subdevice, translate the -- cgit v1.2.3 From 532caaa2f445b22b74b88b4023a810426772db54 Mon Sep 17 00:00:00 2001 From: Harshit Mogalapalli Date: Fri, 25 Sep 2026 05:55:44 -0700 Subject: mtd: virt-concat: unlink concat node before freeing it mtd_virt_concat_create_item() links each new mtd_virt_concat_node to concat_node_list. mtd_virt_concat_destroy() later frees the node after destroying its concatenated MTD device, but fails to unlink it. A later list traversal dereferences the freed node, causing a use-after-free. Remove the node from concat_node_list before freeing it. Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6, smatch Signed-off-by: Harshit Mogalapalli Signed-off-by: Miquel Raynal --- drivers/mtd/mtd_virt_concat.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c index da4277ced4d6..4fad0967a96e 100644 --- a/drivers/mtd/mtd_virt_concat.c +++ b/drivers/mtd/mtd_virt_concat.c @@ -130,6 +130,7 @@ int mtd_virt_concat_destroy(struct mtd_info *mtd) mtd_concat_destroy(&concat->mtd); } + list_del(&item->head); for (idx = 0; idx < item->count; idx++) of_node_put(item->nodes[idx]); -- cgit v1.2.3 From 112a666bd82e96e4a01e0cd8a0fb9c88dd0bce38 Mon Sep 17 00:00:00 2001 From: Harshit Mogalapalli Date: Fri, 25 Sep 2026 05:55:45 -0700 Subject: mtd: virt-concat: unlink discarded items before freeing mtd_virt_concat_destroy_items() frees each item without removing it from concat_node_list. list_for_each_entry_safe() protects the current traversal, but concat_node_list still points to the freed items afterward. The function also unwinds errors from mtd_virt_concat_node_create(). A later initialization can traverse a freed item in mtd_is_part_concat(), causing a use-after-free. Unlink each item before freeing it. Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6, smatch Signed-off-by: Harshit Mogalapalli Signed-off-by: Miquel Raynal --- drivers/mtd/mtd_virt_concat.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c index 4fad0967a96e..637219e20b80 100644 --- a/drivers/mtd/mtd_virt_concat.c +++ b/drivers/mtd/mtd_virt_concat.c @@ -202,6 +202,7 @@ void mtd_virt_concat_destroy_items(void) int i; list_for_each_entry_safe(item, temp, &concat_node_list, head) { + list_del(&item->head); for (i = 0; i < item->count; i++) of_node_put(item->nodes[i]); -- cgit v1.2.3 From 2f7fa8d90694d21dce68ceabd8383252b111cfea Mon Sep 17 00:00:00 2001 From: Weigang He Date: Sat, 26 Sep 2026 14:28:53 +1000 Subject: mtd: parsers: qcom: fix offset/size overflow on large partitions In parse_qcomsmem_part() the partition offset and size are computed as parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize; parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize; Both le32_to_cpu() and mtd->erasesize are 32-bit (u32). The multiply is therefore evaluated in 32-bit arithmetic and the product is truncated to 32 bits before being widened and stored into the 64-bit (u64) parts[j].offset / parts[j].size fields, so the 64-bit destinations are never used at their full width. The SMEM partition table is firmware-provided and the per-entry offset and length are not bounds-checked against the device geometry (only numparts is capped). On a sufficiently large flash, a partition whose (offset|length) * erasesize is >= 2^32 gets a silently truncated offset/size and is mapped to the wrong region of the master MTD, which can overlap or extend into an unintended area. Cast one operand to u64 so the multiplication is performed in 64-bit and the result fits the 64-bit fields without truncation. Found by static analysis tool CodeQL. Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser") Cc: stable@vger.kernel.org Assisted-by: LLM codeql Signed-off-by: Weigang He Signed-off-by: Miquel Raynal --- drivers/mtd/parsers/qcomsmempart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c index d4fdc46a0073..1591aea48b28 100644 --- a/drivers/mtd/parsers/qcomsmempart.c +++ b/drivers/mtd/parsers/qcomsmempart.c @@ -143,9 +143,9 @@ static int parse_qcomsmem_part(struct mtd_info *mtd, *c = tolower(*c); parts[j].name = name; - parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize; + parts[j].offset = (u64)le32_to_cpu(pentry->offset) * mtd->erasesize; parts[j].mask_flags = pentry->attr; - parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize; + parts[j].size = (u64)le32_to_cpu(pentry->length) * mtd->erasesize; pr_debug("%d: %s offs=0x%08x size=0x%08x attr:0x%08x\n", i, pentry->name, le32_to_cpu(pentry->offset), le32_to_cpu(pentry->length), pentry->attr); -- cgit v1.2.3