Skip to content

[pull] master from torvalds:master #1951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Jun 21, 2025
Merged

Conversation

pull[bot]
Copy link

@pull pull bot commented Jun 21, 2025

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

maurizio-lombardi and others added 9 commits June 16, 2025 14:35
…i_port()

The function core_scsi3_decode_spec_i_port(), in its error code path,
unconditionally calls core_scsi3_lunacl_undepend_item() passing the
dest_se_deve pointer, which may be NULL.

This can lead to a NULL pointer dereference if dest_se_deve remains
unset.

SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
Unable to handle kernel paging request at virtual address dfff800000000012
Call trace:
  core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
  core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
  core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
  target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]

Fix this by adding a NULL check before calling
core_scsi3_lunacl_undepend_item()

Signed-off-by: Maurizio Lombardi <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Mike Christie <[email protected]>
Reviewed-by: John Meneghini <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
strsep() modifies the address of the pointer passed to it so that it no
longer points to the original address. This means kfree() gets the wrong
pointer.

Fix this by passing unmodified pointer returned from kstrdup() to
kfree().

Found by Linux Verification Center (linuxtesting.org) with Svace.

Fixes: 4df84e8 ("scsi: elx: efct: Driver initialization routines")
Signed-off-by: Vitaliy Shevtsov <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Daniel Wagner <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
The idea behind this patch was to always let a "master" mtd device
available to anchor runtime PM. Historically, there was no mtd device
representing the whole storage as soon as partitions were coming into
play. The introduction of CONFIG_MTD_PARTITIONED_MASTER allowed to keep
this "master" device, but was not enabled by default to avoid breaking
existing users (otherwise the mtd device numbering would be totally
messed up with an off by 1, at least).

The approach of adding an mtd_master class on top of partitioned mtd
devices is breaking the mtd core in many creative ways, so better think
again this approach and revert the faulty changes for now.

This reverts commit 0aa7b39.

Fixes: 0aa7b39 ("mtd: core: always create master device")
Tested-by: Guenter Roeck <[email protected]>
Acked-by: Guenter Roeck <[email protected]>
Signed-off-by: Miquel Raynal <[email protected]>
There's been a mistake when extracting the geometry of the W35N02 and
W35N04 chips from the datasheet. There is a single plane, however there
are respectively 2 and 4 LUNs. They are actually referred in the
datasheet as dies (equivalent of target), but as there is no die select
operation and the chips only feature a single configuration register for
the entire chip (instead of one per die), we can reasonably assume we
are talking about LUNs and not dies.

Reported-by: Andreas Dannenberg <[email protected]>
Suggested-by: Vignesh Raghavendra <[email protected]>
Fixes: 25e08bf ("mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips")
Cc: [email protected]
Signed-off-by: Miquel Raynal <[email protected]>
The default number of dummy cycles is 16 in octal I/O mode (1S-8S-8S),
and with this default configuration the maximum frequency is higher than
what is being advertised. There are higher and lower frequency
possibilities, which involve making changes in the number of dummy
cycles through the VCR register. At this stage, let's just describe the
default configuration correctly. There should be no functional change.

Fixes: 1ac5ff2 ("mtd: spinand: winbond: Add octal support")
Signed-off-by: Miquel Raynal <[email protected]>
…/O variants

Dual and quad capable chips natively support dual and quad I/O variants
at up to 104MHz (1-2-2 and 1-4-4 operations). Reaching the maximum speed
of 166MHz is theoretically possible (while still unsupported in the
field) by adding a few more dummy cycles. Let's be accurate and clearly
state this limit.

Setting a maximum frequency implies adding the frequency parameter to
the macro, which is done using a variadic argument to avoid impacting
all the other drivers which already make use of this macro.

Fixes: 1ea808b ("mtd: spinand: winbond: Update the *JW chip definitions")
Signed-off-by: Miquel Raynal <[email protected]>
Memory allocated for the ECC engine conf is not released during spinand
cleanup. Below kmemleak trace is seen for this memory leak:

unreferenced object 0xffffff80064f00e0 (size 8):
  comm "swapper/0", pid 1, jiffies 4294937458
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc+0x30/0x40
    __kmalloc_cache_noprof+0x208/0x3c0
    spinand_ondie_ecc_init_ctx+0x114/0x200
    nand_ecc_init_ctx+0x70/0xa8
    nanddev_ecc_engine_init+0xec/0x27c
    spinand_probe+0xa2c/0x1620
    spi_mem_probe+0x130/0x21c
    spi_probe+0xf0/0x170
    really_probe+0x17c/0x6e8
    __driver_probe_device+0x17c/0x21c
    driver_probe_device+0x58/0x180
    __device_attach_driver+0x15c/0x1f8
    bus_for_each_drv+0xec/0x150
    __device_attach+0x188/0x24c
    device_initial_probe+0x10/0x20
    bus_probe_device+0x11c/0x160

Fix the leak by calling nanddev_ecc_engine_cleanup() inside
spinand_cleanup().

Signed-off-by: Pablo Martin-Gomez <[email protected]>
Signed-off-by: Miquel Raynal <[email protected]>
…it/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two small and obvious driver fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
…nux/kernel/git/mtd/linux

Pull mtd fixes from Miquel Raynal:
 "The main fix that really needs to get in is the revert of the patch
  adding the new mtd_master class, because it entirely fails the
  partitioning if a specific Kconfig option is set. We need to think how
  to handle that differently, so let's revert it as we need to get back
  to the pen and paper situation again.

  Otherwise the definition of some Winbond SPI NAND chips are receiving
  some fixes (geometry and maximum frequency, mostly).

  And finally a small memory leak gets also fixed"

* tag 'mtd/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: spinand: fix memory leak of ECC engine conf
  mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants
  mtd: spinand: winbond: Increase maximum frequency on an octal operation
  mtd: spinand: winbond: Fix W35N number of planes/LUN
  Revert "mtd: core: always create master device"
@pull pull bot added the ⤵️ pull label Jun 21, 2025
@pull pull bot merged commit 3f75bff into AwesomeGitHubRepos:master Jun 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants