public inbox for linux-mtd@lists.infradead.org
 help / color / mirror / Atom feed
From: Frieder Schrempf <frieder@fris.de>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>,
	stable@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-mtd@lists.infradead.org,
	Miquel Raynal <miquel.raynal@bootlin.com>,
	Richard Weinberger <richard@nod.at>,
	Vignesh Raghavendra <vigneshr@ti.com>
Cc: Daniel Golle <daniel@makrotopia.org>, Dhruva Gole <d-gole@ti.com>,
	Frieder Schrempf <frieder.schrempf@kontron.de>
Subject: [PATCH 6.1.y] mtd: spinand: macronix: use scratch buffer for DMA operation
Date: Tue, 10 Mar 2026 18:15:44 +0100	[thread overview]
Message-ID: <20260310171544.1568499-1-frieder@fris.de> (raw)

From: Daniel Golle <daniel@makrotopia.org>

[ Upstream commit ebed787a0becb9354f0a23620a5130cccd6c730c ]

The mx35lf1ge4ab_get_eccsr() function uses an SPI DMA operation to
read the eccsr, hence the buffer should not be on stack. Since commit
380583227c0c7f ("spi: spi-mem: Add extra sanity checks on the op param")
the kernel emmits a warning and blocks such operations.

Use the scratch buffer to get eccsr instead of trying to directly read
into a stack-allocated variable.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/Y8i85zM0u4XdM46z@makrotopia.org
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
---
This backport fixes the following error in 6.1:

[  102.320032] WARNING: CPU: 0 PID: 537 at drivers/spi/spi-mem.c:216 spi_mem_check_op+0x15c/0x168
[  102.328775] Modules linked in: bluetooth rfkill ipv6 snd_soc_fsl_asrc
[  102.335289] CPU: 0 PID: 537 Comm: nandtest Not tainted 6.1.158-ktn #1
[  102.341745] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
[  102.347943]  unwind_backtrace from show_stack+0x10/0x14
[  102.353203]  show_stack from dump_stack_lvl+0x24/0x2c
[  102.358280]  dump_stack_lvl from __warn+0x74/0x120
[  102.363092]  __warn from warn_slowpath_fmt+0x178/0x188
[  102.368250]  warn_slowpath_fmt from spi_mem_check_op+0x15c/0x168
[  102.374286]  spi_mem_check_op from spi_mem_exec_op+0x3c/0x3e0
[  102.380063]  spi_mem_exec_op from mx35lf1ge4ab_ecc_get_status+0x9c/0xf8
[  102.386712]  mx35lf1ge4ab_ecc_get_status from spinand_ondie_ecc_finish_io_req+0x38/0x9c
[  102.394748]  spinand_ondie_ecc_finish_io_req from spinand_mtd_read+0x184/0x350
[  102.401998]  spinand_mtd_read from mtd_read_oob+0x98/0x160
[  102.407517]  mtd_read_oob from mtd_read+0x5c/0x80
[  102.412247]  mtd_read from mtdchar_read+0x108/0x2bc
[  102.417158]  mtdchar_read from vfs_read+0x98/0x24c
[  102.421977]  vfs_read from sys_pread64+0x8c/0xb8
[  102.426613]  sys_pread64 from ret_fast_syscall+0x0/0x54
[  102.431858] Exception stack(0xe0ce1fa8 to 0xe0ce1ff0)
[  102.436922] 1fa0:                   00200000 00000000 00000003 b6e1f008 00040000 00000000
[  102.445110] 1fc0: 00200000 00000000 00000001 000000b4 b6ff3220 b6e1f008 b6e1f008 b6ddf008
[  102.453294] 1fe0: 000000b4 be925b38 b6f3d611 b6ec1b26
[  102.458414] ---[ end trace 0000000000000000 ]---
---
 drivers/mtd/nand/spi/macronix.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/spi/macronix.c b/drivers/mtd/nand/spi/macronix.c
index dce835132a1e2..722a9738ba370 100644
--- a/drivers/mtd/nand/spi/macronix.c
+++ b/drivers/mtd/nand/spi/macronix.c
@@ -83,9 +83,10 @@ static int mx35lf1ge4ab_ecc_get_status(struct spinand_device *spinand,
 		 * in order to avoid forcing the wear-leveling layer to move
 		 * data around if it's not necessary.
 		 */
-		if (mx35lf1ge4ab_get_eccsr(spinand, &eccsr))
+		if (mx35lf1ge4ab_get_eccsr(spinand, spinand->scratchbuf))
 			return nanddev_get_ecc_conf(nand)->strength;
 
+		eccsr = *spinand->scratchbuf;
 		if (WARN_ON(eccsr > nanddev_get_ecc_conf(nand)->strength ||
 			    !eccsr))
 			return nanddev_get_ecc_conf(nand)->strength;
-- 
2.53.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

             reply	other threads:[~2026-03-10 17:16 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-10 17:15 Frieder Schrempf [this message]
2026-03-21 14:43 ` Patch "mtd: spinand: macronix: use scratch buffer for DMA operation" has been added to the 6.1-stable tree gregkh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260310171544.1568499-1-frieder@fris.de \
    --to=frieder@fris.de \
    --cc=d-gole@ti.com \
    --cc=daniel@makrotopia.org \
    --cc=frieder.schrempf@kontron.de \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=miquel.raynal@bootlin.com \
    --cc=richard@nod.at \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=vigneshr@ti.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox