* [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
[not found] <cover.1752024352.git.khairul.anuar.romli@altera.com>
@ 2025-07-09 1:30 ` khairul.anuar.romli
2025-07-09 1:34 ` Matthew Gerlach
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: khairul.anuar.romli @ 2025-07-09 1:30 UTC (permalink / raw)
To: Tudor Ambarus, Pratyush Yadav, Michael Walle, Miquel Raynal,
Richard Weinberger, Vignesh Raghavendra,
open list:SPI NOR SUBSYSTEM, open list, Matthew Gerlach,
Khairul Anuar Romli
From: kromli <khairul.anuar.romli@altera.com>
Ensure that the pointer passed to module_put() in spi_nor_put_device() is
not NULL before use. This change adds a guard clause to return early,
preventing the kernel crash below when the cadence-qspi driver is removed
during a dd operation:
[ 200.448732] Unable to handle kernel NULL pointer deref
erence at virtual address 0000000000000010
[ 200.457576] Mem abort info:
[ 200.460370] ESR = 0x0000000096000004
[ 200.464136] EC = 0x25: DABT (current EL), IL = 32 bits
[ 200.469527] SET = 0, FnV = 0
[ 200.472609] EA = 0, S1PTW = 0
[ 200.475904] FSC = 0x04: level 0 translation fault
[ 200.480786] Data abort info:
[ 200.483659] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 200.489141] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 200.494189] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 200.499500] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000185df8000
[ 200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
[ 200.512720] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 200.518968] Modules linked in: 8021q garp mrp stp llc bluetooth ecdh_generic
ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
_fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6
[ 200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
c4179a6 #1
[ 200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
[ 200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 200.560234] pc : spi_nor_put_device+0x30/0x60
[ 200.564594] lr : __put_mtd_device+0x8c/0x120
[ 200.568856] sp : ffff80008411bc20
[ 200.572161] x29: ffff80008411bc20 x28: ffff000185e2c500 x27: 0000000000000000
[ 200.579282] x26: 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88
[ 200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21: ffff00018873e080
[ 200.593524] x20: 0000000000000000 x19: ffff00018873e080 x18: ffffffffffffffff
[ 200.600645] x17: 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700
[ 200.607767] x14: 0000000000000000 x13: ffff000180045010 x12: ffff0001857576c0
[ 200.614888] x11: 000000000000003a x10: ffff000180045018 x9 : ffff000180045010
[ 200.622009] x8 : ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048
[ 200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 : 0000000000000000
[ 200.636250] x2 : 0000000000000000 x1 : ffff00018873e080 x0 : 0000000000000000
[ 200.643371] Call trace:
[ 200.645811] spi_nor_put_device+0x30/0x60
[ 200.649816] __put_mtd_device+0x8c/0x120
[ 200.653731] put_mtd_device+0x30/0x48
[ 200.657387] mtdchar_close+0x30/0x78
[ 200.660958] __fput+0xc8/0x2d0
[ 200.664011] ____fput+0x14/0x20
[ 200.667146] task_work_run+0x70/0xdc
[ 200.670718] do_exit+0x2b4/0x8e4
[ 200.673944] do_group_exit+0x34/0x90
[ 200.677512] pid_child_should_wake+0x0/0x60
[ 200.681686] invoke_syscall+0x48/0x104
[ 200.685432] el0_svc_common.constprop.0+0xc0/0xe0
[ 200.690128] do_el0_svc+0x1c/0x28
[ 200.693439] el0_svc+0x30/0xcc
[ 200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency
[ 200.696485] el0t_64_sync_handler+0x120/0x12c
[ 200.706552] el0t_64_sync+0x190/0x194
[ 200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800)
[ 200.716290] ---[ end trace 0000000000000000 ]---
[ 200.720948] Fixing recursive fault but reboot is needed!
Fixes: be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing resources during read/write")
CC: stable@vger.kernel.org # 6.12+
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
---
drivers/mtd/spi-nor/core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index ac4b960101cc..501e48a342ad 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info *mtd)
if (!try_module_get(dev->driver->owner))
return -ENODEV;
+ if (!dev && !dev->driver && !dev->driver->owner)
+ return -EINVAL;
+
return 0;
}
@@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info *mtd)
else
dev = nor->dev;
- module_put(dev->driver->owner);
+ if (dev && dev->driver && dev->driver->owner)
+ module_put(dev->driver->owner);
}
static void spi_nor_restore(struct spi_nor *nor)
--
2.35.3
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
2025-07-09 1:30 ` [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations khairul.anuar.romli
@ 2025-07-09 1:34 ` Matthew Gerlach
2025-07-09 14:33 ` Michael Walle
2025-07-14 19:29 ` Dan Carpenter
2 siblings, 0 replies; 7+ messages in thread
From: Matthew Gerlach @ 2025-07-09 1:34 UTC (permalink / raw)
To: khairul.anuar.romli, Tudor Ambarus, Pratyush Yadav, Michael Walle,
Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
open list:SPI NOR SUBSYSTEM, open list
On 7/8/25 6:30 PM, khairul.anuar.romli@altera.com wrote:
> From: kromli <khairul.anuar.romli@altera.com>
>
> Ensure that the pointer passed to module_put() in spi_nor_put_device() is
> not NULL before use. This change adds a guard clause to return early,
> preventing the kernel crash below when the cadence-qspi driver is removed
> during a dd operation:
Let's get this submitted!
>
> [ 200.448732] Unable to handle kernel NULL pointer deref
> erence at virtual address 0000000000000010
> [ 200.457576] Mem abort info:
> [ 200.460370] ESR = 0x0000000096000004
> [ 200.464136] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 200.469527] SET = 0, FnV = 0
> [ 200.472609] EA = 0, S1PTW = 0
> [ 200.475904] FSC = 0x04: level 0 translation fault
> [ 200.480786] Data abort info:
> [ 200.483659] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> [ 200.489141] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 200.494189] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 200.499500] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000185df8000
> [ 200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
> [ 200.512720] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
> [ 200.518968] Modules linked in: 8021q garp mrp stp llc bluetooth ecdh_generic
> ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
> _fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6
> [ 200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
> c4179a6 #1
> [ 200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
> [ 200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 200.560234] pc : spi_nor_put_device+0x30/0x60
> [ 200.564594] lr : __put_mtd_device+0x8c/0x120
> [ 200.568856] sp : ffff80008411bc20
> [ 200.572161] x29: ffff80008411bc20 x28: ffff000185e2c500 x27: 0000000000000000
> [ 200.579282] x26: 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88
> [ 200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21: ffff00018873e080
> [ 200.593524] x20: 0000000000000000 x19: ffff00018873e080 x18: ffffffffffffffff
> [ 200.600645] x17: 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700
> [ 200.607767] x14: 0000000000000000 x13: ffff000180045010 x12: ffff0001857576c0
> [ 200.614888] x11: 000000000000003a x10: ffff000180045018 x9 : ffff000180045010
> [ 200.622009] x8 : ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048
> [ 200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 : 0000000000000000
> [ 200.636250] x2 : 0000000000000000 x1 : ffff00018873e080 x0 : 0000000000000000
> [ 200.643371] Call trace:
> [ 200.645811] spi_nor_put_device+0x30/0x60
> [ 200.649816] __put_mtd_device+0x8c/0x120
> [ 200.653731] put_mtd_device+0x30/0x48
> [ 200.657387] mtdchar_close+0x30/0x78
> [ 200.660958] __fput+0xc8/0x2d0
> [ 200.664011] ____fput+0x14/0x20
> [ 200.667146] task_work_run+0x70/0xdc
> [ 200.670718] do_exit+0x2b4/0x8e4
> [ 200.673944] do_group_exit+0x34/0x90
> [ 200.677512] pid_child_should_wake+0x0/0x60
> [ 200.681686] invoke_syscall+0x48/0x104
> [ 200.685432] el0_svc_common.constprop.0+0xc0/0xe0
> [ 200.690128] do_el0_svc+0x1c/0x28
> [ 200.693439] el0_svc+0x30/0xcc
> [ 200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency
> [ 200.696485] el0t_64_sync_handler+0x120/0x12c
> [ 200.706552] el0t_64_sync+0x190/0x194
> [ 200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800)
> [ 200.716290] ---[ end trace 0000000000000000 ]---
> [ 200.720948] Fixing recursive fault but reboot is needed!
>
> Fixes: be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing resources during read/write")
> CC: stable@vger.kernel.org # 6.12+
> Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
> Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
> ---
> drivers/mtd/spi-nor/core.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index ac4b960101cc..501e48a342ad 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info *mtd)
> if (!try_module_get(dev->driver->owner))
> return -ENODEV;
>
> + if (!dev && !dev->driver && !dev->driver->owner)
> + return -EINVAL;
> +
> return 0;
> }
>
> @@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info *mtd)
> else
> dev = nor->dev;
>
> - module_put(dev->driver->owner);
> + if (dev && dev->driver && dev->driver->owner)
> + module_put(dev->driver->owner);
> }
>
> static void spi_nor_restore(struct spi_nor *nor)
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
2025-07-09 1:30 ` [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations khairul.anuar.romli
2025-07-09 1:34 ` Matthew Gerlach
@ 2025-07-09 14:33 ` Michael Walle
2025-07-15 7:53 ` Romli, Khairul Anuar
2025-07-14 19:29 ` Dan Carpenter
2 siblings, 1 reply; 7+ messages in thread
From: Michael Walle @ 2025-07-09 14:33 UTC (permalink / raw)
To: khairul.anuar.romli, Tudor Ambarus, Pratyush Yadav, Miquel Raynal,
Richard Weinberger, Vignesh Raghavendra,
open list:SPI NOR SUBSYSTEM, open list, Matthew Gerlach
Hi,
> Ensure that the pointer passed to module_put() in spi_nor_put_device() is
> not NULL before use. This change adds a guard clause to return early,
> preventing the kernel crash below when the cadence-qspi driver is removed
> during a dd operation:
>
> [ 200.448732] Unable to handle kernel NULL pointer deref
> erence at virtual address 0000000000000010
> [ 200.457576] Mem abort info:
> [ 200.460370] ESR = 0x0000000096000004
> [ 200.464136] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 200.469527] SET = 0, FnV = 0
> [ 200.472609] EA = 0, S1PTW = 0
> [ 200.475904] FSC = 0x04: level 0 translation fault
> [ 200.480786] Data abort info:
> [ 200.483659] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> [ 200.489141] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 200.494189] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 200.499500] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000185df8000
> [ 200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
> [ 200.512720] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
> [ 200.518968] Modules linked in: 8021q garp mrp stp llc bluetooth ecdh_generic
> ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
> _fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6
> [ 200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
> c4179a6 #1
> [ 200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
> [ 200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 200.560234] pc : spi_nor_put_device+0x30/0x60
> [ 200.564594] lr : __put_mtd_device+0x8c/0x120
> [ 200.568856] sp : ffff80008411bc20
> [ 200.572161] x29: ffff80008411bc20 x28: ffff000185e2c500 x27: 0000000000000000
> [ 200.579282] x26: 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88
> [ 200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21: ffff00018873e080
> [ 200.593524] x20: 0000000000000000 x19: ffff00018873e080 x18: ffffffffffffffff
> [ 200.600645] x17: 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700
> [ 200.607767] x14: 0000000000000000 x13: ffff000180045010 x12: ffff0001857576c0
> [ 200.614888] x11: 000000000000003a x10: ffff000180045018 x9 : ffff000180045010
> [ 200.622009] x8 : ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048
> [ 200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 : 0000000000000000
> [ 200.636250] x2 : 0000000000000000 x1 : ffff00018873e080 x0 : 0000000000000000
> [ 200.643371] Call trace:
> [ 200.645811] spi_nor_put_device+0x30/0x60
> [ 200.649816] __put_mtd_device+0x8c/0x120
> [ 200.653731] put_mtd_device+0x30/0x48
> [ 200.657387] mtdchar_close+0x30/0x78
> [ 200.660958] __fput+0xc8/0x2d0
> [ 200.664011] ____fput+0x14/0x20
> [ 200.667146] task_work_run+0x70/0xdc
> [ 200.670718] do_exit+0x2b4/0x8e4
> [ 200.673944] do_group_exit+0x34/0x90
> [ 200.677512] pid_child_should_wake+0x0/0x60
> [ 200.681686] invoke_syscall+0x48/0x104
> [ 200.685432] el0_svc_common.constprop.0+0xc0/0xe0
> [ 200.690128] do_el0_svc+0x1c/0x28
> [ 200.693439] el0_svc+0x30/0xcc
> [ 200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency
> [ 200.696485] el0t_64_sync_handler+0x120/0x12c
> [ 200.706552] el0t_64_sync+0x190/0x194
> [ 200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800)
> [ 200.716290] ---[ end trace 0000000000000000 ]---
> [ 200.720948] Fixing recursive fault but reboot is needed!
>
> Fixes: be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing resources during read/write")
> CC: stable@vger.kernel.org # 6.12+
> Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
> Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
> ---
> drivers/mtd/spi-nor/core.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> index ac4b960101cc..501e48a342ad 100644
> --- a/drivers/mtd/spi-nor/core.c
> +++ b/drivers/mtd/spi-nor/core.c
> @@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info *mtd)
> if (!try_module_get(dev->driver->owner))
> return -ENODEV;
>
> + if (!dev && !dev->driver && !dev->driver->owner)
> + return -EINVAL;
> +
> return 0;
> }
>
> @@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info *mtd)
> else
> dev = nor->dev;
>
> - module_put(dev->driver->owner);
> + if (dev && dev->driver && dev->driver->owner)
> + module_put(dev->driver->owner);
Why is dev->driver or dev->driver->owner NULL in the first place?
-michael
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
2025-07-09 1:30 ` [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations khairul.anuar.romli
2025-07-09 1:34 ` Matthew Gerlach
2025-07-09 14:33 ` Michael Walle
@ 2025-07-14 19:29 ` Dan Carpenter
2025-07-15 0:15 ` Romli, Khairul Anuar
2 siblings, 1 reply; 7+ messages in thread
From: Dan Carpenter @ 2025-07-14 19:29 UTC (permalink / raw)
To: oe-kbuild, khairul.anuar.romli, Tudor Ambarus, Pratyush Yadav,
Michael Walle, Miquel Raynal, Richard Weinberger,
Vignesh Raghavendra, open list:SPI NOR SUBSYSTEM, open list,
Matthew Gerlach
Cc: lkp, oe-kbuild-all
Hi,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/khairul-anuar-romli-altera-com/mtd-spi-nor-core-Prevent-oops-during-driver-removal-with-active-read-or-write-operations/20250709-103107
base: https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git spi-nor/next
patch link: https://lore.kernel.org/r/e439e6b85e650a91607a1d02d5d432d096363315.1752024352.git.khairul.anuar.romli%40altera.com
patch subject: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
config: i386-randconfig-141-20250711 (https://download.01.org/0day-ci/archive/20250711/202507110922.btkgvYrn-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202507110922.btkgvYrn-lkp@intel.com/
smatch warnings:
drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable dereferenced before check 'dev' (see line 3213)
drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable dereferenced before check 'dev->driver' (see line 3213)
vim +/dev +3216 drivers/mtd/spi-nor/core.c
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3202 static int spi_nor_get_device(struct mtd_info *mtd)
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3203 {
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3204 struct mtd_info *master = mtd_get_master(mtd);
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3205 struct spi_nor *nor = mtd_to_spi_nor(master);
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3206 struct device *dev;
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3207
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3208 if (nor->spimem)
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3209 dev = nor->spimem->spi->controller->dev.parent;
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3210 else
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3211 dev = nor->dev;
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3212
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 @3213 if (!try_module_get(dev->driver->owner))
^^^^^^^^^^^^^^^^^^
Dereference
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3214 return -ENODEV;
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3215
240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 @3216 if (!dev && !dev->driver && !dev->driver->owner)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
These checks are done too late. Also missing module put.
240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 3217 return -EINVAL;
240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 3218
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3219 return 0;
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3220 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
2025-07-14 19:29 ` Dan Carpenter
@ 2025-07-15 0:15 ` Romli, Khairul Anuar
0 siblings, 0 replies; 7+ messages in thread
From: Romli, Khairul Anuar @ 2025-07-15 0:15 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild@lists.linux.dev, Tudor Ambarus,
Pratyush Yadav, Michael Walle, Miquel Raynal, Richard Weinberger,
Vignesh Raghavendra, open list:SPI NOR SUBSYSTEM, open list,
Gerlach, Matthew
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev
> From: Dan Carpenter <dan.carpenter@linaro.org>
> Sent: Tuesday, 15 July, 2025 3:30 AM
> To: oe-kbuild@lists.linux.dev; Romli, Khairul Anuar
> <khairul.anuar.romli@altera.com>; Tudor Ambarus
> <tudor.ambarus@linaro.org>; Pratyush Yadav <pratyush@kernel.org>;
> Michael Walle <mwalle@kernel.org>; Miquel Raynal
> <miquel.raynal@bootlin.com>; Richard Weinberger <richard@nod.at>;
> Vignesh Raghavendra <vigneshr@ti.com>; open list:SPI NOR SUBSYSTEM
> <linux-mtd@lists.infradead.org>; open list <linux-kernel@vger.kernel.org>;
> Gerlach, Matthew <matthew.gerlach@altera.com>
> Cc: lkp@intel.com; oe-kbuild-all@lists.linux.dev
> Subject: Re: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver
> removal with active read or write operations
>
> Hi,
>
> kernel test robot noticed the following build warnings:
>
> https://git-/
> scm.com%2Fdocs%2Fgit-format-
> patch%23_base_tree_information&data=05%7C02%7Ckhairul.anuar.romli%4
> 0altera.com%7Cf6c3b8bb5b844138259308ddc30cd2ae%7Cfbd72e03d4a54
> 110adce614d51f2077a%7C0%7C0%7C638881182091182847%7CUnknow
> n%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIl
> AiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sd
> ata=eR42SdwIvE8%2BT3uUpe1WKz%2Fn0V4DNnLHExb1IPi1Gas%3D&reserv
> ed=0]
>
> url:
> https://gith/
> ub.com%2Fintel-lab-lkp%2Flinux%2Fcommits%2Fkhairul-anuar-romli-altera-
> com%2Fmtd-spi-nor-core-Prevent-oops-during-driver-removal-with-active-
> read-or-write-operations%2F20250709-
> 103107&data=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb
> 5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f2077a%
> 7C0%7C0%7C638881182091208992%7CUnknown%7CTWFpbGZsb3d8eyJF
> bXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT
> WFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=KJm%2FUt2CNwr3J2
> Gsoxd2oe36gitqmmby3df73UWsZHo%3D&reserved=0
> base:
> https://git.k/
> ernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Fmtd%2Flinux.git&dat
> a=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb5b8441382
> 59308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f2077a%7C0%7C0%
> 7C638881182091223786%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hc
> GkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIld
> UIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=u3%2FCugi1Z%2BobMTJu5qWFj
> 4tkjYr%2FgC4PGVt0NJvAktA%3D&reserved=0 spi-nor/next
> patch link:
> https://lore/.
> kernel.org%2Fr%2Fe439e6b85e650a91607a1d02d5d432d096363315.1752
> 024352.git.khairul.anuar.romli%2540altera.com&data=05%7C02%7Ckhairul.
> anuar.romli%40altera.com%7Cf6c3b8bb5b844138259308ddc30cd2ae%7C
> fbd72e03d4a54110adce614d51f2077a%7C0%7C0%7C6388811820912375
> 62%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLj
> AuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%
> 7C%7C%7C&sdata=sy%2BIZORvA8IgYI5BZsHEQgoIH9wKyndszhYwQ6N7vzw
> %3D&reserved=0
> patch subject: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver
> removal with active read or write operations
> config: i386-randconfig-141-20250711
> (https://do/
> wnload.01.org%2F0day-
> ci%2Farchive%2F20250711%2F202507110922.btkgvYrn-
> lkp%40intel.com%2Fconfig&data=05%7C02%7Ckhairul.anuar.romli%40altera
> .com%7Cf6c3b8bb5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110ad
> ce614d51f2077a%7C0%7C0%7C638881182091250946%7CUnknown%7CT
> WFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJX
> aW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=zvj
> oJvmjeQnS7dTajwXbAB6GiqNwecZtS3win3Sv7lM%3D&reserved=0)
> compiler: clang version 20.1.8
> (https://gith/
> ub.com%2Fllvm%2Fllvm-
> project&data=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb
> 5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f2077a%
> 7C0%7C0%7C638881182091264782%7CUnknown%7CTWFpbGZsb3d8eyJF
> bXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT
> WFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=FYcm8fzKMhihgW5At
> oVRcGTCV56qKYNlx3uJpT%2B4DPo%3D&reserved=0
> 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> | Closes:
> |
> https://lore/
> | .kernel.org%2Fr%2F202507110922.btkgvYrn-
> lkp%40intel.com%2F&data=05%7C0
> |
> 2%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb5b844138259308ddc3
> 0cd2a
> |
> e%7Cfbd72e03d4a54110adce614d51f2077a%7C0%7C0%7C638881182091
> 278235%7CUn
> |
> known%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAw
> MCIsIlAiOi
> |
> JXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=
> NMmQgJov
> | ArDDW9sbKYrmIdl3lTRLvDD2SNq10pYeQ9s%3D&reserved=0
>
> smatch warnings:
> drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable
> dereferenced before check 'dev' (see line 3213)
> drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable
> dereferenced before check 'dev->driver' (see line 3213)
>
> vim +/dev +3216 drivers/mtd/spi-nor/core.c
>
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3202
> static int spi_nor_get_device(struct mtd_info *mtd)
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3203
> {
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3204
> struct mtd_info *master = mtd_get_master(mtd);
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3205
> struct spi_nor *nor = mtd_to_spi_nor(master);
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3206
> struct device *dev;
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3207
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3208
> if (nor->spimem)
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3209
> dev = nor->spimem->spi->controller->dev.parent;
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3210
> else
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3211
> dev = nor->dev;
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3212
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01
> @3213 if (!try_module_get(dev->driver->owner))
> ^^^^^^^^^^^^^^^^^^
> Dereference
>
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3214
> return -ENODEV;
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3215
> 240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 @3216
> if (!dev && !dev->driver && !dev->driver->owner)
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> These checks are done too late. Also missing module put.
I will send the v2 revision to fix this. I don't think we need module put. Module put
Will cause the kernel oops if any of the nodes are null.
>
> 240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 3217
> return -EINVAL;
> 240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 3218
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3219
> return 0;
> be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3220
> }
>
> --
> 0-DAY CI Kernel Test Service
> https://gith/
> ub.com%2Fintel%2Flkp-
> tests%2Fwiki&data=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3
> b8bb5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f20
> 77a%7C0%7C0%7C638881182091292007%7CUnknown%7CTWFpbGZsb3d
> 8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkF
> OIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=SSQX73%2Bm
> m3Eqb6XaYih3tHM7sL5d%2Fuodt3DggYXTBNc%3D&reserved=0
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
2025-07-09 14:33 ` Michael Walle
@ 2025-07-15 7:53 ` Romli, Khairul Anuar
[not found] ` < <BY5PR03MB5299D68304D916F466837E6BC657A@BY5PR03MB5299.namprd03.prod.outlook.com>
0 siblings, 1 reply; 7+ messages in thread
From: Romli, Khairul Anuar @ 2025-07-15 7:53 UTC (permalink / raw)
To: Michael Walle, Tudor Ambarus, Pratyush Yadav, Miquel Raynal,
Richard Weinberger, Vignesh Raghavendra,
open list:SPI NOR SUBSYSTEM, open list, Gerlach, Matthew
> From: Michael Walle <mwalle@kernel.org>
>
> Hi,
>
> > Ensure that the pointer passed to module_put() in spi_nor_put_device()
> > is not NULL before use. This change adds a guard clause to return
> > early, preventing the kernel crash below when the cadence-qspi driver
> > is removed during a dd operation:
> >
> > [ 200.448732] Unable to handle kernel NULL pointer deref erence at
> > virtual address 0000000000000010 [ 200.457576] Mem abort info:
> > [ 200.460370] ESR = 0x0000000096000004
> > [ 200.464136] EC = 0x25: DABT (current EL), IL = 32 bits
> > [ 200.469527] SET = 0, FnV = 0
> > [ 200.472609] EA = 0, S1PTW = 0
> > [ 200.475904] FSC = 0x04: level 0 translation fault
> > [ 200.480786] Data abort info:
> > [ 200.483659] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> > [ 200.489141] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> > [ 200.494189] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> > [ 200.499500] user pgtable: 4k pages, 48-bit VAs,
> > pgdp=0000000185df8000 [ 200.505932] [0000000000000010]
> > pgd=0000000000000000, p4d=0000000000000000 [ 200.512720]
> Internal
> > error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 200.518968]
> Modules
> > linked in: 8021q garp mrp stp llc bluetooth ecdh_generic ecc rfkill
> > crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
> > _fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm
> > backlight ipv6 [ 200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not
> > tainted 6.12.19-altera-gb6b26
> > c4179a6 #1
> > [ 200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT) [
> > 200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS
> > BTYPE=--) [ 200.560234] pc : spi_nor_put_device+0x30/0x60 [
> > 200.564594] lr : __put_mtd_device+0x8c/0x120 [ 200.568856] sp :
> > ffff80008411bc20 [ 200.572161] x29: ffff80008411bc20 x28:
> > ffff000185e2c500 x27: 0000000000000000 [ 200.579282] x26:
> > 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88 [
> > 200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21:
> > ffff00018873e080 [ 200.593524] x20: 0000000000000000 x19:
> > ffff00018873e080 x18: ffffffffffffffff [ 200.600645] x17:
> > 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700 [
> > 200.607767] x14: 0000000000000000 x13: ffff000180045010 x12:
> > ffff0001857576c0 [ 200.614888] x11: 000000000000003a x10:
> > ffff000180045018 x9 : ffff000180045010 [ 200.622009] x8 :
> > ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048 [
> > 200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 :
> 0000000000000000 [ 200.636250] x2 : 0000000000000000 x1 :
> ffff00018873e080 x0 : 0000000000000000 [ 200.643371] Call trace:
> > [ 200.645811] spi_nor_put_device+0x30/0x60 [ 200.649816]
> > __put_mtd_device+0x8c/0x120 [ 200.653731]
> put_mtd_device+0x30/0x48 [
> > 200.657387] mtdchar_close+0x30/0x78 [ 200.660958]
> __fput+0xc8/0x2d0
> > [ 200.664011] ____fput+0x14/0x20 [ 200.667146]
> > task_work_run+0x70/0xdc [ 200.670718] do_exit+0x2b4/0x8e4 [
> > 200.673944] do_group_exit+0x34/0x90 [ 200.677512]
> > pid_child_should_wake+0x0/0x60 [ 200.681686]
> > invoke_syscall+0x48/0x104 [ 200.685432]
> > el0_svc_common.constprop.0+0xc0/0xe0
> > [ 200.690128] do_el0_svc+0x1c/0x28
> > [ 200.693439] el0_svc+0x30/0xcc
> > [ 200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency [
> > 200.696485] el0t_64_sync_handler+0x120/0x12c [ 200.706552]
> > el0t_64_sync+0x190/0x194 [ 200.710213] Code: f9400000 f9417c00
> > f9402000 f9403400 (f9400800) [ 200.716290] ---[ end trace
> > 0000000000000000 ]--- [ 200.720948] Fixing recursive fault but reboot
> > is needed!
> >
> > Fixes: be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing
> > resources during read/write")
> > CC: stable@vger.kernel.org # 6.12+
> > Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
> > Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
> > ---
> > drivers/mtd/spi-nor/core.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
> > index ac4b960101cc..501e48a342ad 100644
> > --- a/drivers/mtd/spi-nor/core.c
> > +++ b/drivers/mtd/spi-nor/core.c
> > @@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info
> *mtd)
> > if (!try_module_get(dev->driver->owner))
> > return -ENODEV;
> >
> > + if (!dev && !dev->driver && !dev->driver->owner)
> > + return -EINVAL;
> > +
> > return 0;
> > }
> >
> > @@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info
> *mtd)
> > else
> > dev = nor->dev;
> >
> > - module_put(dev->driver->owner);
> > + if (dev && dev->driver && dev->driver->owner)
> > + module_put(dev->driver->owner);
>
> Why is dev->driver or dev->driver->owner NULL in the first place?
When we remove/unbind the the spi node during busy, we will hit with dev->driver and dev->driver->owner NULL derefence.
This eventually leads to the oops that I included in the commit message body.
>
> -michael
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
[not found] ` < <BY5PR03MB5299D68304D916F466837E6BC657A@BY5PR03MB5299.namprd03.prod.outlook.com>
@ 2025-07-16 6:46 ` Michael Walle
0 siblings, 0 replies; 7+ messages in thread
From: Michael Walle @ 2025-07-16 6:46 UTC (permalink / raw)
To: Romli, Khairul Anuar, Tudor Ambarus, Pratyush Yadav,
Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
open list:SPI NOR SUBSYSTEM, open list, Gerlach, Matthew
[-- Attachment #1: Type: text/plain, Size: 535 bytes --]
Hi,
On Tue Jul 15, 2025 at 9:53 AM CEST, Khairul Anuar Romli wrote:
> > > - module_put(dev->driver->owner);
> > > + if (dev && dev->driver && dev->driver->owner)
> > > + module_put(dev->driver->owner);
> >
> > Why is dev->driver or dev->driver->owner NULL in the first place?
>
> When we remove/unbind the the spi node during busy, we will hit
> with dev->driver and dev->driver->owner NULL derefence.
Yes, but my question was why is this the case? I.e. why is
dev or dev->driver NULL?
-michael
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 297 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-07-16 6:46 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <cover.1752024352.git.khairul.anuar.romli@altera.com>
2025-07-09 1:30 ` [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations khairul.anuar.romli
2025-07-09 1:34 ` Matthew Gerlach
2025-07-09 14:33 ` Michael Walle
2025-07-15 7:53 ` Romli, Khairul Anuar
[not found] ` < <BY5PR03MB5299D68304D916F466837E6BC657A@BY5PR03MB5299.namprd03.prod.outlook.com>
2025-07-16 6:46 ` Michael Walle
2025-07-14 19:29 ` Dan Carpenter
2025-07-15 0:15 ` Romli, Khairul Anuar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).