From patchwork Thu Sep 3 03:14:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "NG, TZE YEE" X-Patchwork-Id: 2297173 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=BvHHoB/7; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=altera.com header.i=@altera.com header.a=rsa-sha256 header.s=selector2 header.b=hMWj7zqk; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hb4TZ21gxz1y03 for ; Thu, 03 Sep 2026 13:14:58 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=sCworj7vOk07YCWsqFZLPH5WVJg6Dm4kNeR3EjIypM4=; b=BvHHoB/7GiqiWG J4sNOC3busy4ZV/kCUKrHdN2x3Mm+NFPTW5BSBMBMl8RwJyYBZfd2XgQ/oU4YdxWQrTUbncpcRTLO Gkj0TvasbOBrZEm0EMvsSOa1ZeZfk9dck1+vDs6j+5OR1/87NOdsdgAcXEGSZhyhpAnY5BISUwchi 6WEUNzo+t/fNImI+edpPnlzhhF7qiFAxzpBZ6YelLHwy1xSkTtnuSV0lHwsdbgHByGpuAl8UtLPpP WtXfoNE0A85egls8E2RWl2sQCLpREGmcjHnZEKaZ+B2ds6McvvjuiAq5NfQp+im5mR67MOz1V8GkU blMeJsza6dMU7IEhBmDA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x1xuY-0000000GGSH-2t8C; Thu, 03 Sep 2026 03:14:46 +0000 Received: from mail-eastusazlp170120007.outbound.protection.outlook.com ([2a01:111:f403:c101::7] helo=BL0PR03CU003.outbound.protection.outlook.com) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x1xuW-0000000GGQ8-00rT for linux-mtd@lists.infradead.org; Thu, 03 Sep 2026 03:14:45 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=WCzhe8R67wTFKp6Q3RRtJzungJxnsDNk4j4ulHl21EkJZ0kXD7WwIxLPRSKzR9IzzKk0SogxCTEQkvBe3puAi5fxnuxZf6Ac0Mg4aSxo0cLNpYxUGQB+SSYOfh58GBMdfFDvPJhdKNYFmZdwRAjieppQ/4zCuZwZ5HI2eFUK5GFcsp4YFqXtlxnuNKSc+aaaICxPHf8WQy8ZlYdHnOml8DB2vtcco9C314QVl5ptr3Po8G29+KUod+jXXfv+ykYVeNQMrvjhsgSsNfkv5nW3GyoB3czjbrf/XVOnSXhqhqwFp5l2XDxwFPqIRRK3/efsSWltsfisOnlwcsocxZWM5w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pfUx3CQqSbQz+BR8yoM11FHZAACWDdzxG9fSJPbB7vI=; b=hObf3EyCio5CEBzPnn/whqSFnrmjPCHeDqBzMom+TkFyUpIg5xkgNQitqRPxTfxW4lcJPATNQvKJ5LrRjl2XC02CO+G1ueFwcNDoWv4e6ZaCpQ62ZU63n3w4SBrkAn25Uha1NKvqW0ngFn6+X2OcjQIYnlccEomB1jC0oh46GuEvmYeGXsVqmjuiIYrbN0uI+nzIYtQgMxCY42m2t9hiKKDcWh8Sz+EL+PRSLy0B6Hlq35doOw2qP8+3DJJc/nngerDgiYhigUoUbo9083yQ47PLmmBjqiW4iiXyMrFVto6I2nF+KZQr7V3316egE6jBOwvgFk4Q7BLT1qoMZn6XgQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=altera.com; dmarc=pass action=none header.from=altera.com; dkim=pass header.d=altera.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=altera.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pfUx3CQqSbQz+BR8yoM11FHZAACWDdzxG9fSJPbB7vI=; b=hMWj7zqkIPRDUyJdtg8j0HFvLhxIuaOBqKEb1tPfAWW8r1sVcKNTzJYC1rqMjqNmBxlRxtJhvNOkQ6W84f93fQ7QwCMg1tAgAkRHaf5k9AOjDF9X4jd81XzkAKz5rSQiUh8hSoP9bwWcwph74wB9Wjq26PjCBHe8PTR2opNfl1FGGNDW9dPb7Xpedr/LKcXvZ+xgdAmGWR1etY8RPbb8yzN49gtAe+C/SkJ7AualMNR2hEwWpcn7KMnYHZOy/Xsoi1BXvW/b88o9O8s/bL3cSvlEqJN/0h7nI6a1ATHjIGpFxu6hYgrlrL5j/d87tK1iRl1eP7bE3SVtHZrP/YiUug== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=altera.com; Received: from SJ0PR03MB5950.namprd03.prod.outlook.com (2603:10b6:a03:2d3::20) by LV3PR03MB7502.namprd03.prod.outlook.com (2603:10b6:408:19c::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 03:14:37 +0000 Received: from SJ0PR03MB5950.namprd03.prod.outlook.com ([fe80::53a0:bf93:6b6b:de01]) by SJ0PR03MB5950.namprd03.prod.outlook.com ([fe80::53a0:bf93:6b6b:de01%5]) with mapi id 15.21.0360.008; Thu, 3 Sep 2026 03:14:37 +0000 From: tze.yee.ng@altera.com To: Pratyush Yadav , Michael Walle , Takahiro Kuwano , Tudor Ambarus , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] mtd: spi-nor: Fix deadlock in spi_nor_rww_start_exclusive() Date: Thu, 3 Sep 2026 11:14:28 +0800 Message-ID: <46e4e2e31f051f64c120307216ce2766c004d9af.1788404586.git.tze.yee.ng@altera.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: References: X-ClientProxiedBy: BY5PR04CA0028.namprd04.prod.outlook.com (2603:10b6:a03:1d0::38) To SJ0PR03MB5950.namprd03.prod.outlook.com (2603:10b6:a03:2d3::20) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ0PR03MB5950:EE_|LV3PR03MB7502:EE_ X-MS-Office365-Filtering-Correlation-Id: b68305cc-f3d4-45ca-fdda-08df09697c1e X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|366016|376014|10067099003|18002099003|22082099003|55112099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: tvTRRWzfLbCdEv74H3I+KccqP2viP6mTTyg6V5kVBpXjAxqYm8TAwJe4Wl0QBsnfNwxFS4uN5KG+Z0VKxo8pyPo5Y46jacIqTqLCILXno51tEq3JXfhSe5wpf7toCSJeZlTkmCeJk4RuOXrTeAM619uFWltm/EeI/Mzl8BYKx2wa7cF7XlNQfxZTYYMLLdMzQ+nfqE1mNs0Kn0bdfHXiVB4oEiELANEQAi/kl5D26qFpq3zvbvdXlUGfWg3GaMXPyGyLRi8+t6hNLWQ4gGdbWznBgyrtbx7eioPj2MyluEHuMZql4Jgpn3iL3zV6/Rzu3/5QT32O9WW1g4lSmDpuwRmnaNE3PyCAzkl251KP9dc5YYVtFGOgRF2H31MigSGs3PJ+IbzK+4ajXttll2fTduDwlsKmXpTWJ0sGX8tGcMyoPKP0XtS5Ky1CV2T41DutYQH5hH9Tj8OwSo/n7PM8Rj9Ch0C8y2lFlUUGrZFCWtDzf0HPgSAlmyunZpdl0MNBwSp8G2aoiEpgMhBzG/vdUtHHqwSgCfqqW4JBdwbytLWVEh4oYgdzohgAXRehflj8XOLdUIUzbqraapTh5nlouwAzgQPlZIDFnR17aKrUZHb0C6xnQqUQGWDS3zcHi+HSuHTNHkin08FABacC4heTymgzRTr6JaC0PRdH3A0oliw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ0PR03MB5950.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(366016)(376014)(10067099003)(18002099003)(22082099003)(55112099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 5Irf+aTn6HTLT1HC/Vi2x9N/nxzGe2kj2tlCv/spEGlyWzqlLI5g+BXTl9C+uoJfJuBLSedsrUSOID63sSqvTN1NLezp/6vQL8vYLkG4Slt88bYXOWdP0o+P1Jm++PTn9/FrfiQY3+V2hzz2pMK+mBENAOztkENyGsY+kQQ8rwYGA3uacLM0c/Mj4LW9MEn6isHyxNOzc8NV6i4BLURNAr4Fij3bcFiz2ZXEIMSc7RNcJ/4fUyiabgfhRD6g/SKxHex36hILgsUCMeMhF95hPeXPVYbkL04VhVqLzQ9swLgdnK4xV4o29Muy99gEiGf0G/niUK1+gPQs3l+9bz7Shn59VN/rDeaeaj0iWRdxI4o110s5/zo6FUiCFjo8tcV6Tenlsjf2CShFvR0LxDm/x91KxGmb+IKjE0yjGbKxu5W+s5/H68yAgR5KO44JZUKDahVwQqr5EsOdzh4ZIsmBd63aUtOr4+fYHEApiYqLj3omaReOBdz6426C3AIn5WBD4lVTUgjpzuLvYME5j0aQplZhcylV8Kzbvvip3ooFK7WRO+H6UDLJHpJQ/9+fErAqc319W+MVMvLSWoKL3hdEYBd8+Es2sl5wKyjYGtMm5AqIDbpdFpWIvsQXxyFSL4qAGPFQ83WlAAZS+ElA/l8RQ3YUtJbT1/+OOLqDPiMr3SPt+SJUi79UnCWSg8rz4JJjWYo5vGuzZO+39XsEXZpubGInHnbK4cptvLGb5krsV0tuV/WdsOE3eGgykBwryrEEVhmOdVlAs2D2+NDagaHzK178CvXEotopZ+uh6JhqJfplF/9mAYi1wAckjpB9UHe8AqC9c/N+sC2sOl6w7l35enujtAKg7XGhOG+1WIrdyfJlrjwmoNipSfHOCG3hNAR5zMAnlS5in6Ezs69zcIPoW8LjF6oFaJfGSnl9Ela0MbEAz6R1pZSN15kM7RXlFpa593Inrkn0VdR6NTTfOm1911gd0U+XHrnsZbYcQUxyj89jegtLNOUuAi+mBjzJlq651jjkbrkFB3fttU4Wg24kumQZtOrssLpDKY4xiphR/0L2ec24FT41tk4sJAbgpDucdh2UsfRQQOIG5lrslvf5VvTh120rkKfbUv5v2ZYznSbZkWhE4vFZxP0pQ1I2RMCV5fU5pLCzbVe9j2aOiwrBInNrJa/Htv8q0VAdQ19E1F+XCRnv5Q4d3336rDRex7xcAUgXndRrUpi3zeRYX39PBNv/UqLi2dCyjcoSYjYawEilXg2cZREzDpvzDKw2rSDRortp3GUkZuJMIKRkA5wF0I4hAC5/2lrv7Zwjo2Fegu1NW0C5zDebMO+Lgdid/0DUyOlfBsMkGERCuFkQaVdDn4q2X0KBmLPAE6Y5dt6Z0hVekYa95E1p8QWx22ZCHIsH7x1Cr5wp7Zkd1QwAsje/IFj95vIqEFoQo8L5aBh1dtGTAuTX6kmqMrQF1TK4dTCPnXrOUBj3MzYGCbkSLipB50oktvoOrYg+aNw5IzQH/vcRNGib/qCbk0DVxdTrLnpk8QW4q9NbwhRXQoenIVHG8shQT5HBYjPAbZ6sYo7MSmfzkp9Q+EGWYrGCj/jsixYwkehXFo96i8KBzzgi5mWaCFoGP0aKZMO0CLmY+Y80iZ8ImvqZTGO6alldOqrzn6D4BDpQNnGG/+h1MQTl93sgeIeODY+bSs9CZz2aXGgV+jJ7MrA6IIh/pRESs3Hy1Hm1nE4VWMd0oM1v7W0Wo+Nv5A== X-OriginatorOrg: altera.com X-MS-Exchange-CrossTenant-Network-Message-Id: b68305cc-f3d4-45ca-fdda-08df09697c1e X-MS-Exchange-CrossTenant-AuthSource: SJ0PR03MB5950.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 03:14:37.2602 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: fbd72e03-d4a5-4110-adce-614d51f2077a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: xhWNaAfOtpHzg/YQR7PhZ+f+WDzNSzZwGOPdjeBCJoe51WyA3VTbSS4K9/WIr4FsZ8MCVl69iGYGDJIqMC/NBQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR03MB7502 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260902_201444_041130_CA49D5D2 X-CRM114-Status: UNSURE ( 9.92 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.1 (--) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Tze Yee Ng spi_nor_rww_start_exclusive() takes nor->lock with a bare mutex_lock() and returns with it held, while its counterpart spi_nor_rww_end_exclusive() re-acquires nor->lock via guard(mutex). Any exclusive [...] Content analysis details: (-2.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2a01:111:f403:c101:0:0:0:7 listed in] [list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.0 DMARC_PASS DMARC pass policy X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org From: Tze Yee Ng spi_nor_rww_start_exclusive() takes nor->lock with a bare mutex_lock() and returns with it held, while its counterpart spi_nor_rww_end_exclusive() re-acquires nor->lock via guard(mutex). Any exclusive operation on a read-while-write (SNOR_F_RWW) part thus deadlocks against itself. The exclusive section is serialized by the rww ongoing_io/rd/pe flags, so take nor->lock with guard(mutex) like the sibling start helpers. Fixes: 03e7bb864d9a9 ("mtd: spi-nor: use scope-based mutex cleanup helpers") Cc: stable@vger.kernel.org Signed-off-by: Tze Yee Ng --- drivers/mtd/spi-nor/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index ccf4396cdcd0..8bc117b46e02 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -1310,7 +1310,7 @@ static bool spi_nor_rww_start_exclusive(struct spi_nor *nor) { struct spi_nor_rww *rww = &nor->rww; - mutex_lock(&nor->lock); + guard(mutex)(&nor->lock); if (rww->ongoing_io || rww->ongoing_rd || rww->ongoing_pe) return false; From patchwork Thu Sep 3 03:14:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "NG, TZE YEE" X-Patchwork-Id: 2297174 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=QCUxt+Pw; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=altera.com header.i=@altera.com header.a=rsa-sha256 header.s=selector2 header.b=Ds9ykrDl; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hb4TZ2rXdz1y06 for ; Thu, 03 Sep 2026 13:14:58 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=6FRxECAd3bWyeYybl5DqVL0ySI4eZSYZkGt278L4HjQ=; b=QCUxt+PwY13JuK 49kkqWKVscrg6057xR+/JrRilBi+fU6BQ35ZKg5wHMG4T5hG+za3hBX4uylOiAHanRAORNMvKRlOK wEgk7tJ247c3DHOhHXPXzgf5SdX19Um4ZBAH6+J52c0fsv/XPN292GJ/OIAXHccVH0k6d6tMyI40l vVsjWbErlDJow+J4Y2Qonp2BqfQp0OXkeW1KYi1G42GD48ahcvDczGyRRyTGfPMLhbaowr2JSut5s Qqv6vy1AOYE1kL8alW1OIhry+xZzn23WUk8NyBt5RKF7uG7JFvqekYVjA0GrxDyVeP6fBnWzXr+8+ Xy8FqsqUAOzbAPatioXg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x1xuZ-0000000GGSr-3yBc; Thu, 03 Sep 2026 03:14:47 +0000 Received: from mail-eastusazlp170120007.outbound.protection.outlook.com ([2a01:111:f403:c101::7] helo=BL0PR03CU003.outbound.protection.outlook.com) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x1xuX-0000000GGQ8-1G8y for linux-mtd@lists.infradead.org; Thu, 03 Sep 2026 03:14:47 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=O3uSC/cpw25qhn6KCOmwe07ZHVp+wDeJckpdkmZbVdUwH8wJlDa7E/5EiZZgOPhR+g7bM/i76PKg8OMs8SSqTNv3S0eNsQqh2ciS29UqHn8RZflPGj+QIfB2n/xWxfvRIcLHZoe26sY4ENYN2jxItJyMDFluPkLcF63dDreCOEyKrMOU/GSGEMGlep7rX4zEHjz9C966WxcK+To7YC3m0rQlY90cJhHk/82lzRgSzJwx+go+zssESVHzbYApu2WtPIuSygQoev0G/5UXgznOW3Vh4TvfnbW5tnUh/5xBIDyo96wW/RKM0NNGN+lMi5FLPjovojAb3LgOKTizht2+5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MorNBA9OFytyo59EJMC3oXslyh4NETslPXu1eu9W1Aw=; b=cAFsoyzXDtrzeKW3KmXYdIs0f9rR5Qy/EBxqA7sMY0MkKiRTjbU3xYR5r9XqF8SrWR8QAU9jC7WvaC2yOBQYRw7VJxKZxLnKnfM+h4rRLHmc2+LCzp7D9/Qdj1WbAfZ+DbYX2RGorQcXvs4gYvhyUMcnvQXZ/TC+TXehXwivTmSmTVrMFxeZXFrr0YM3PvW5fO15ZKTHi7jBKMQq5Skc1dYglv5O1g8wQgOU8LuLfHWGJCKdv3gPeBIHqXZXBuakj97oNR3wBaWOVEjncyTfkVfw13iPdnLjm7esMuGy/yid9ZmzirsNkC2ForMgPulJkSCNe3cnK8oeEEXj3goZQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=altera.com; dmarc=pass action=none header.from=altera.com; dkim=pass header.d=altera.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=altera.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MorNBA9OFytyo59EJMC3oXslyh4NETslPXu1eu9W1Aw=; b=Ds9ykrDlEXZUooZaGWbh231H+f+P6NY104PROSJVdLCh6hrP6StB7pp3h0trE8XIJftg0woeVHm/+s+KUWr/NcCYv4Cd5nhEQRWnnhqhMk9WS9Sq3d/5qdeVuRKZxY0F0eK6E1764n1JARyWgjSguclxn/Ih2sGcASFOzhR6RHQU3SAZ3yIuaOnvb9HswtUjKe8PwjgA3S/WpawwutFt2DVnlHZnrYPtQwg+WzMNPqWjX8nO1cvOTDzDPIu6a3nFGptHGvHe84pDuSZR4/ectNyH3KMllyYdJPO57PV4ulWF2CUDVxfEZcKprwaocJ5nDj6uQY3XPRbcR/NRZG2t0w== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=altera.com; Received: from SJ0PR03MB5950.namprd03.prod.outlook.com (2603:10b6:a03:2d3::20) by LV3PR03MB7502.namprd03.prod.outlook.com (2603:10b6:408:19c::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 03:14:39 +0000 Received: from SJ0PR03MB5950.namprd03.prod.outlook.com ([fe80::53a0:bf93:6b6b:de01]) by SJ0PR03MB5950.namprd03.prod.outlook.com ([fe80::53a0:bf93:6b6b:de01%5]) with mapi id 15.21.0360.008; Thu, 3 Sep 2026 03:14:39 +0000 From: tze.yee.ng@altera.com To: Pratyush Yadav , Michael Walle , Takahiro Kuwano , Tudor Ambarus , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] mtd: spi-nor: core: Fix use-after-free of spi_nor on unbind with open handles Date: Thu, 3 Sep 2026 11:14:29 +0800 Message-ID: <91e1b12d15d18361f77e5cca934fd4b37a47805b.1788404586.git.tze.yee.ng@altera.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: References: X-ClientProxiedBy: BY5PR04CA0028.namprd04.prod.outlook.com (2603:10b6:a03:1d0::38) To SJ0PR03MB5950.namprd03.prod.outlook.com (2603:10b6:a03:2d3::20) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ0PR03MB5950:EE_|LV3PR03MB7502:EE_ X-MS-Office365-Filtering-Correlation-Id: a0a90fa9-549f-4e61-1360-08df09697d7a X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|366016|376014|10067099003|18002099003|22082099003|55112099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: jVQ3kcPPgg9s9QMHAJwo/3nPUBD1lJDXBlxLMu0H+fNasWs5FZfIb5okMq5vFwG8haLnhqqHh8rtrwXWqZoufmWM519vnL1eOP+K7nrDvbItVboSmSoaBCbYoYnE1H3DTzFHEbzWvq9DyUZzafl6ZQmRazfktsvt3W1HzjXPH3EPDCLJnfRUJyXOysi6fqiVdtIVv7Med2hjGm56KuzjnxqOBUAQuT0j22aWzplT6dhbZcPlxEbYNtjSy94U4OEcC+i+7Ql06/4kYHb2YD/dltmXUCwgOsLmUNmy2wVsMw0VIbJTRniLiyKhhtbMIGnswG/xabtuudGEHQ6YtYIjjy7EucyIQKy4qTUxf4Hp81g/s5gmQbYMe5bWEDN5FqDik+i8x8voCd0ykZOT85qUnht3nSQt6jtMsOZG2j7gQWIkXGRGWWb6ClsmWMQYatWu0qJveuswOY73u5nz8QNzqlQm9++PVERihJJGjCp7TFBJw1QuqFplLYrEtRgN7Z4Lzmpv+NQAB6u8Dcms8L0DGmlaoKZXiWP0P3gmIkRCBl5ciGMEy9kMaovwiBSPw+viv1cpkkznMbuutj+cui+kvzzKWZ7wsbrwlIOPXug4Z7sWzN92bXXVNgtaja4rLBFQtrIt64DHi/xwwtzFc//A3HGnbOkmiDLP/D6ygzTgbto= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ0PR03MB5950.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(366016)(376014)(10067099003)(18002099003)(22082099003)(55112099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: sdYUAq+1V95nbv9fmVSn1nQmiq1iULaDhxsoBBmXqtRFTV7IOOgdig4c08sqwC0+lxtZecUxfz5zBwmI6RiPvMlgRtvWJirQ1AAiHyrzVf5RbG1Vx89aoBKjjqSJEOnRm/iGIMzQSOb5obwe6l1R4GEGUp4XLJR194SnfiswRphEkPJhRi/WzitjrMq1SXXyFw7GVLO+Ged4Dr9aHyF9tsNqGSReUNpjyf5ZyCkaCV68c1BGVggmdOmAuQCuLknI+0WNGeYnMpNUcovcsn1ngvBXYhBIGpwMFr//Tr8LefH89GwSG8adXfXzVCc92T0prf5I/bO9xpHuBBW4PTGWNgqCWX04ADBgo3jThnGfELHD40Bp9J/ZM2QP4ro+tRvQUox9gpSBvdO1JHhJoHxXJnR2xK50vzzkGtMwBAkL0sOqx9+E20mlLcfVt2r7R/hgkMW1Q6ay+e2L0n+PSMornYP9++7O66ow/U8dtanl150P7KZZvagiLvIt4Hyts3DbJ2FnWm6wdynmmzCOQdL8ogri0lLbTGz+dJ4+DBgqNDLs3+JG6zkpa1lbhWdj4+hYxjFlcfO8XHezSHyVBgpWOwK+Ik78D4AyMF+tLfQIeynGJCu1ISy1WDu426uQO6Tcf+Un0/Y5l6f7TnqCioVUnaRnVrrfXea8qeqCcB/B6MjmMg7IHTif+pIU0EWNoNtiDj0ckYA8zX5lqWFhLOWvy2AnzRDD2MwVqMqA958sqT2I4Ai4hxl1uiwqFuVp0fDzHcPNveqaCAm/oBvdCNN+YgMHatzEB1v8td30Z90YN7+62cH7Z7nwi4o4JKyKhfkAYb0vmaPyzrO+Pr7PhK/Ux1jlkKhvREQj0LrgyZpCj2vic4RPTBrt1wGiWhJjrETzxF0Q0Pi4vZUDaA1Zw4yvYwCWuNU5QzerSRdLhhZoDGqNNwmPsY1AZEWHOlZS1gMQjm1ZS5SeFiNoSSI8OfFqFVDV+17scr5mIe5thPrhRXU/IAFGf24iT5gGmmuJlocTlmduopxaVoUWIX/VW6aLRN7x+G2IVfAI3VpBgGf4T+cEcLf0xCTq8M3YDvaDArLk4lRh+wb6rc6olWVRHlFH5YLLgTJJVvt8XbXqGXFHFn4GJZ6M2qf8Epnx7UOSB/8kobEhzlcbdM7kGMzY8uHeAHCA0Gldkwh8rxS5RUG+Cp4nrERfr6Ro4MRSxjx0oaAClo7gYvV9Dj1+2Zm+f2jCcL+V0fuqlgKkOH/dMA5sa7yvZ3b3WgWn0N1q2q/Cki0FMtoNTfCpj0Uccw7lNaCU8Evh28IUQguhhoA/SD+g3M3KybXx+Z/QGsFp/wb+duY799z5VhNk7RVnElQIBnYTCHgEzz0wzgBzPczHlPeqIapjS6nmvcALqh3L2SoA1d+p2exhSkiWFJj6lU1+1HhEElfLBOom18kv4bdPgBg7tzbprFn01V15L5DxNm13fK7BKrnzQ0jy7UwOdtAmBUhC+IaKNpkRGZhxU6xW5qwVC9DDVJ0p9AOtoHcz1dxByBrbtQXUoQe30SPn5TQNhA+g+ay2c8ssFt4kUxOlAFKz39q7PKUTpjZKgQvtS9hxxM+KeL89utZNOX7zlpzkDnkElRl1NzSO2f29dktKAqR2rE9oKtD6cyaBYZJRb6V17647SPQeySiOfoDysn9JVYpFjj41dOzGqbyl3TkpG6om5RtrlXoNdB01mwIuSgjKa6s4U/7SIme2TlpeDsT4aqtcTw== X-OriginatorOrg: altera.com X-MS-Exchange-CrossTenant-Network-Message-Id: a0a90fa9-549f-4e61-1360-08df09697d7a X-MS-Exchange-CrossTenant-AuthSource: SJ0PR03MB5950.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 03:14:39.4435 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: fbd72e03-d4a5-4110-adce-614d51f2077a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ra1L+89vLhSQ82zMQJrC5A0hnBPyTQ8Odw88SbqAEgfShYJbOWJ04O5xfTpjdpcyIEVgo5/8jcH9meH/WdjCPw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR03MB7502 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260902_201445_421673_BD9E778A X-CRM114-Status: GOOD ( 20.55 ) X-Spam-Score: -2.1 (--) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Tze Yee Ng The spi_nor is allocated with devm_kzalloc() on the SPI device, so a sysfs unbind frees it while /dev/mtdX is still open. A later close then oopses in spi_nor_put_device()->module_put() on the freed s [...] Content analysis details: (-2.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2a01:111:f403:c101:0:0:0:7 listed in] [list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.0 DMARC_PASS DMARC pass policy X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org From: Tze Yee Ng The spi_nor is allocated with devm_kzalloc() on the SPI device, so a sysfs unbind frees it while /dev/mtdX is still open. A later close then oopses in spi_nor_put_device()->module_put() on the freed spi_nor. try_module_get() does not help: it blocks rmmod, not an unbind. Give the spi_nor (and its params and bouncebuf) a kref lifetime on the spi-mem probe path so it survives until the last MTD user is gone, and cache the controller module for the put path. The spimem and dirmaps stay owned by the SPI core, so spi_nor_remove() drains in-flight operations and sets nor->removed to fail later ones with -ENODEV. Legacy controllers are unchanged. Signed-off-by: Tze Yee Ng --- drivers/mtd/spi-nor/core.c | 111 ++++++++++++++++++++++++++++++++---- include/linux/mtd/spi-nor.h | 17 ++++++ 2 files changed, 118 insertions(+), 10 deletions(-) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index 8bc117b46e02..7fb61dde58f5 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -45,6 +45,9 @@ #define SPI_NOR_SRST_SLEEP_MIN 200 #define SPI_NOR_SRST_SLEEP_MAX 400 +static void spi_nor_unlock_and_unprep_pe(struct spi_nor *nor, loff_t start, size_t len); +static void spi_nor_unlock_and_unprep_rd(struct spi_nor *nor, loff_t start, size_t len); + /** * spi_nor_get_cmd_ext() - Get the command opcode extension based on the * extension type. @@ -1345,8 +1348,15 @@ int spi_nor_prep_and_lock(struct spi_nor *nor) else ret = wait_event_killable(nor->rww.wait, spi_nor_rww_start_exclusive(nor)); + if (ret) + return ret; - return ret; + if (nor->removed) { + spi_nor_unlock_and_unprep(nor); + return -ENODEV; + } + + return 0; } void spi_nor_unlock_and_unprep(struct spi_nor *nor) @@ -1416,8 +1426,15 @@ static int spi_nor_prep_and_lock_pe(struct spi_nor *nor, loff_t start, size_t le else ret = wait_event_killable(nor->rww.wait, spi_nor_rww_start_pe(nor, start, len)); + if (ret) + return ret; - return ret; + if (nor->removed) { + spi_nor_unlock_and_unprep_pe(nor, start, len); + return -ENODEV; + } + + return 0; } static void spi_nor_unlock_and_unprep_pe(struct spi_nor *nor, loff_t start, size_t len) @@ -1489,8 +1506,15 @@ static int spi_nor_prep_and_lock_rd(struct spi_nor *nor, loff_t start, size_t le else ret = wait_event_killable(nor->rww.wait, spi_nor_rww_start_rd(nor, start, len)); + if (ret) + return ret; - return ret; + if (nor->removed) { + spi_nor_unlock_and_unprep_rd(nor, start, len); + return -ENODEV; + } + + return 0; } static void spi_nor_unlock_and_unprep_rd(struct spi_nor *nor, loff_t start, size_t len) @@ -3186,7 +3210,12 @@ static int spi_nor_init_params(struct spi_nor *nor) { int ret; - nor->params = devm_kzalloc(nor->dev, sizeof(*nor->params), GFP_KERNEL); + /* Keep params on the kref lifetime so it survives unbind (see probe). */ + if (nor->refcounted) + nor->params = kzalloc(sizeof(*nor->params), GFP_KERNEL); + else + nor->params = devm_kzalloc(nor->dev, sizeof(*nor->params), + GFP_KERNEL); if (!nor->params) return -ENOMEM; @@ -3420,6 +3449,22 @@ static void spi_nor_resume(struct mtd_info *mtd) dev_err(dev, "resume() failed\n"); } +static void spi_nor_release(struct kref *kref) +{ + struct spi_nor *nor = container_of(kref, struct spi_nor, refcount); + + kfree(nor->bouncebuf); + kfree(nor->params); + kfree(nor); +} + +static void spi_nor_release_device(void *data) +{ + struct spi_nor *nor = data; + + kref_put(&nor->refcount, spi_nor_release); +} + static int spi_nor_get_device(struct mtd_info *mtd) { struct mtd_info *master = mtd_get_master(mtd); @@ -3434,6 +3479,12 @@ static int spi_nor_get_device(struct mtd_info *mtd) if (!try_module_get(dev->driver->owner)) return -ENODEV; + if (nor->refcounted) { + /* Cache the module: the spimem/controller chain may be freed by put time. */ + nor->controller_module = dev->driver->owner; + kref_get(&nor->refcount); + } + return 0; } @@ -3443,6 +3494,14 @@ static void spi_nor_put_device(struct mtd_info *mtd) struct spi_nor *nor = mtd_to_spi_nor(master); struct device *dev; + if (nor->refcounted) { + module_put(nor->controller_module); + + /* Must be last: this may free nor (and the embedded mtd). */ + kref_put(&nor->refcount, spi_nor_release); + return; + } + if (nor->spimem) dev = nor->spimem->spi->controller->dev.parent; else @@ -3655,8 +3714,11 @@ int spi_nor_scan(struct spi_nor *nor, const char *name, * than 1KB) after spi_nor_scan() returns. */ nor->bouncebuf_size = PAGE_SIZE; - nor->bouncebuf = devm_kmalloc(dev, nor->bouncebuf_size, - GFP_KERNEL); + if (nor->refcounted) + nor->bouncebuf = kmalloc(nor->bouncebuf_size, GFP_KERNEL); + else + nor->bouncebuf = devm_kmalloc(dev, nor->bouncebuf_size, + GFP_KERNEL); if (!nor->bouncebuf) return -ENOMEM; @@ -3788,10 +3850,21 @@ static int spi_nor_probe(struct spi_mem *spimem) if (ret) return ret; - nor = devm_kzalloc(dev, sizeof(*nor), GFP_KERNEL); + /* + * An open /dev/mtdX handle can outlive unbind, so manage the spi_nor + * with a kref and drop the probe-time reference from a devres callback. + */ + nor = kzalloc_obj(*nor, GFP_KERNEL); if (!nor) return -ENOMEM; + kref_init(&nor->refcount); + nor->refcounted = true; + + ret = devm_add_action_or_reset(dev, spi_nor_release_device, nor); + if (ret) + return ret; + nor->spimem = spimem; nor->dev = dev; spi_nor_set_flash_node(nor, dev->of_node); @@ -3830,9 +3903,8 @@ static int spi_nor_probe(struct spi_mem *spimem) */ if (nor->params->page_size > PAGE_SIZE) { nor->bouncebuf_size = nor->params->page_size; - devm_kfree(dev, nor->bouncebuf); - nor->bouncebuf = devm_kmalloc(dev, nor->bouncebuf_size, - GFP_KERNEL); + kfree(nor->bouncebuf); + nor->bouncebuf = kmalloc(nor->bouncebuf_size, GFP_KERNEL); if (!nor->bouncebuf) return -ENOMEM; } @@ -3853,6 +3925,25 @@ static int spi_nor_remove(struct spi_mem *spimem) { struct spi_nor *nor = spi_mem_get_drvdata(spimem); + /* + * Drain in-flight operations and set nor->removed under the lock so + * later ones fail with -ENODEV before touching SPI-core state (spimem, + * dirmaps) freed after this returns. The wait is uninterruptible. + */ + if (!spi_nor_use_parallel_locking(nor)) + mutex_lock(&nor->lock); + else + wait_event(nor->rww.wait, spi_nor_rww_start_exclusive(nor)); + + nor->removed = true; + + if (!spi_nor_use_parallel_locking(nor)) { + mutex_unlock(&nor->lock); + } else { + spi_nor_rww_end_exclusive(nor); + wake_up(&nor->rww.wait); + } + spi_nor_restore(nor); /* Clean up MTD stuff. */ diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h index 4b92494827b1..f8d5e3ca8371 100644 --- a/include/linux/mtd/spi-nor.h +++ b/include/linux/mtd/spi-nor.h @@ -7,6 +7,7 @@ #define __LINUX_MTD_SPI_NOR_H #include +#include #include #include @@ -352,6 +353,18 @@ struct spi_nor_flash_parameter; * @rww.used_banks: bitmap of the banks in use * @dev: pointer to an SPI device or an SPI NOR controller device * @spimem: pointer to the SPI memory device + * @refcount: reference count keeping the kzalloc()'d spi_nor alive + * past driver unbind until the last MTD user releases the + * device. Only valid when @refcounted is set. + * @controller_module: controller module pinned in spi_nor_get_device() so + * spi_nor_put_device() need not walk the possibly freed + * spimem/controller chain. Only valid when @refcounted is + * set. + * @refcounted: true when the spi_nor lifetime is kref-managed (the + * spi-mem spi_nor_probe() path). Legacy controllers that + * embed or devres-allocate spi_nor leave this clear. + * @removed: set on unbind to make subsequent MTD operations fail + * with -ENODEV instead of touching released resources. * @bouncebuf: bounce buffer used when the buffer passed by the MTD * layer is not DMA-able * @bouncebuf_size: size of the bounce buffer @@ -393,6 +406,10 @@ struct spi_nor { } rww; struct device *dev; struct spi_mem *spimem; + struct kref refcount; + struct module *controller_module; + bool refcounted; + bool removed; u8 *bouncebuf; size_t bouncebuf_size; u8 *id;