Re: [PATCH 15/58] mtd: rawnand: tegra: retain open-handle state on removal - sashiko-bot

From: sashiko-bot@kernel.org
To: "James Hilliard" <james.hilliard1@gmail.com>,
	"Miquel Raynal" <miquel.raynal@bootlin.com>,
	"Richard Weinberger" <richard@nod.at>,
	"Vignesh Raghavendra" <vigneshr@ti.com>,
	"Brian Norris" <computersforpeace@gmail.com>,
	"Boris Brezillon" <bbrezillon@kernel.org>,
	"Arseniy Krasnov" <AVKrasnov@sberdevices.ru>,
	"Chen-Yu Tsai" <wens@kernel.org>,
	"Jernej Skrabec" <jernej.skrabec@gmail.com>,
	"Samuel Holland" <samuel@sholland.org>,
	"Thomas Gleixner" <tglx@kernel.org>,
	"Vitaly Wool" <vitalywool@gmail.com>,
	"David Woodhouse" <dwmw2@infradead.org>,
	"Russell King" <rmk+kernel@arm.linux.org.uk>,
	"David Woodhouse" <David.Woodhouse@intel.com>,
	"Mike Rapoport" <rppt@kernel.org>,
	"Maxime Coquelin" <mcoquelin.stm32@gmail.com>,
	"Alexandre Torgue" <alexandre.torgue@foss.st.com>,
	"Christophe Kerello" <christophe.kerello@st.com>,
	"Jason Roberts" <jason.e.roberts@intel.com>,
	"Michal Simek" <michal.simek@amd.com>,
	"Boris Brezillon" <boris.brezillon@collabora.com>,
	"Mason Yang" <masonccyang@mxic.com.tw>,
	"Ramuthevar Vadivel Murugan"
	<vadivel.muruganx.ramuthevar@linux.intel.com>,
	"Stefan Agner" <stefan@agner.ch>, "Lucas Stach" <dev@lynxeye.de>,
	"Thierry Reding" <thierry.reding@kernel.org>,
	"Jonathan Hunter" <jonathanh@nvidia.com>,
	"Dmitry Osipenko" <digetx@gmail.com>,
	"Matthias Brugger" <matthias.bgg@gmail.com>,
	"AngeloGioacchino Del Regno"
	<angelogioacchino.delregno@collabora.com>,
	"Jorge Ramirez-Ortiz" <jorge.ramirez@oss.qualcomm.com>,
	"Heiko Stuebner" <heiko@sntech.de>,
	"Yifeng Zhao" <yifeng.zhao@rock-chips.com>,
	"Nicolas Ferre" <nicolas.ferre@microchip.com>,
	"Alexandre Belloni" <alexandre.belloni@bootlin.com>,
	"Claudiu Beznea" <claudiu.beznea@tuxon.dev>,
	"Keguang Zhang" <keguang.zhang@gmail.com>,
	"Jacky Huang" <ychuang3@nuvoton.com>,
	"Shan-Chun Hung" <schung@nuvoton.com>,
	"Frank Li" <Frank.Li@nxp.com>,
	"Sascha Hauer" <s.hauer@pengutronix.de>,
	"Pengutronix Kernel Team" <kernel@pengutronix.de>,
	"Fabio Estevam" <festevam@gmail.com>, "Han Xu" <han.xu@nxp.com>,
	"Liang Yang" <liang.yang@amlogic.com>,
	"Neil Armstrong" <neil.armstrong@linaro.org>,
	"Kevin Hilman" <khilman@baylibre.com>,
	"Jerome Brunet" <jbrunet@baylibre.com>,
	"Martin Blumenstingl" <martin.blumenstingl@googlemail.com>,
	"Manivannan Sadhasivam" <mani@kernel.org>,
	"Kamal Dasu" <kamal.dasu@broadcom.com>,
	"Broadcom internal kernel review list"
	<bcm-kernel-feedback-list@broadcom.com>,
	"Vladimir Zapolskiy" <vz@mleia.com>,
	"Piotr Wojtaszczyk" <piotr.wojtaszczyk@timesys.com>,
	"Paul Cercueil" <paul@crapouillou.net>,
	"Harvey Hunt" <harveyhuntnexus@gmail.com>,
	"Maxim Levitsky" <maximlevitsky@gmail.com>,
	"Michael Walle" <michael@walle.cc>,
	"Srinivas Kandagatla" <srini@kernel.org>
Cc: "Tze Yee Ng" <tze.yee.ng@altera.com>,
	linux-mtd@lists.infradead.org, linux-sunxi@lists.linux.dev,
	imx@lists.linux.dev, linux-amlogic@lists.infradead.org,
	Frank.Li@kernel.org, wsa+renesas@sang-engineering.com
Subject: Re: [PATCH 15/58] mtd: rawnand: tegra: retain open-handle state on removal
Date: Sat, 07 Nov 2026 20:32:11 +0000	[thread overview]
Message-ID: <sashiko-outbox-203299@kernel.org> (raw)
In-Reply-To: <20261107-submit-rawnand-retained-handle-lifetime-v1-v1-15-0181ef0cc4c8@gmail.com>

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] mtd: rawnand: tegra: unclocked register access in
  tegra_nand_irq() [1]
--

commit 6164eede324ed80f4bb2c1a0eea0f8635af28e57
Author: James Hilliard <james.hilliard1@gmail.com>

mtd: rawnand: tegra: retain open-handle state on removal

This commit switches the Tegra NAND chip and controller allocations to
reference-counted release callbacks and disconnects the chip before
suspending the controller on removal.

> diff --git a/drivers/mtd/nand/raw/tegra_nand.c b/drivers/mtd/nand/raw/tegra_nand.c
> index 7f9eb5f042a7e..da7791741b9d4 100644
> --- a/drivers/mtd/nand/raw/tegra_nand.c
> +++ b/drivers/mtd/nand/raw/tegra_nand.c

[ ... ]

> @@ -1232,10 +1254,11 @@ static void tegra_nand_remove(struct platform_device *pdev)
>  
>  	WARN_ON(mtd_device_unregister(mtd));
>  
> -	nand_cleanup(chip);
> +	nand_disconnect(chip);
>  
>  	pm_runtime_put_sync_suspend(ctrl->dev);
>  	pm_runtime_force_suspend(ctrl->dev);
> +	mtd_put_master(mtd);
>  }

[Severity: High]
This problem wasn't introduced by this patch, but can tegra_nand_irq()
access unclocked registers after pm_runtime_force_suspend() [1]?

tegra_nand_probe() registers tegra_nand_irq() with devm_request_irq(), so
the IRQ remains active until devres cleanup runs after tegra_nand_remove()
(and after the err_put_pm path in tegra_nand_probe()) returns.  In the
meantime, pm_runtime_force_suspend() disables ctrl->clk, and any pending or
spurious interrupt before devres frees the IRQ causes tegra_nand_irq() to
read ISR and DMA_MST_CTRL while the controller is unclocked, triggering an
asynchronous external abort on Tegra.

[1] https://sashiko.dev/#/bug/linux-ae385c5a-5cfb-462a-ab95-dd13d6f5e107

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107-submit-rawnand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com?part=15