[PATCH 07/58] mtd: rawnand: sunxi: retain chip state until the final MTD put
James Hilliard
james.hilliard1 at gmail.com
Sat Nov 7 02:16:04 PST 2026
sunxi_nand_chips_cleanup() unregisters each MTD device and immediately
calls nand_cleanup(). Devres subsequently frees the chip and controller.
An open MTD handle can outlive this sequence: another operation or even
closing a writable handle reaches freed metadata and lock storage.
Unregister each MTD device while removal notifiers can still finish I/O,
then disconnect the chip and release the driver's initial MTD lifetime
reference. Defer nand_cleanup() and chip destruction until the final MTD
or device reference is released. Retain the chip name, flash node and
per-sector user-data lengths along with the NAND metadata.
Give the controller a reference for each retained chip and one owned by
devres. Register that devres action first so the IRQ and hardware
resources are released before the initial controller reference. The
shared lock and parent device remain valid until the last chip is
destroyed, while the disconnect gate prevents access to released
hardware resources.
Unwind heap allocations on probe failures, including attach failures for
which nand_scan() does not invoke the detach callback.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 59 +++++++++++++++++++++++++++++----------
1 file changed, 45 insertions(+), 14 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index f41feebe4257..57894ce45065 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -27,6 +27,7 @@
#include <linux/dmaengine.h>
#include <linux/interrupt.h>
#include <linux/iopoll.h>
+#include <linux/mutex.h>
#include <linux/reset.h>
#define NFC_REG_CTL 0x0000
@@ -405,6 +406,13 @@ static inline struct sunxi_nfc *to_sunxi_nfc(struct nand_controller *ctrl)
return container_of(ctrl, struct sunxi_nfc, controller);
}
+static void sunxi_nfc_release(struct nand_controller *controller)
+{
+ struct sunxi_nfc *nfc = to_sunxi_nfc(controller);
+
+ kfree(nfc);
+}
+
static irqreturn_t sunxi_nfc_interrupt(int irq, void *dev_id)
{
struct sunxi_nfc *nfc = dev_id;
@@ -2027,9 +2035,8 @@ static const struct mtd_ooblayout_ops sunxi_nand_ooblayout_ops = {
static void sunxi_nand_detach_chip(struct nand_chip *nand)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
- struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
- devm_kfree(nfc->dev, sunxi_nand->user_data_bytes);
+ kfree(sunxi_nand->user_data_bytes);
sunxi_nand->user_data_bytes = NULL;
}
@@ -2045,8 +2052,7 @@ static int sunxi_nfc_maximize_user_data(struct nand_chip *nand, uint32_t oobsize
if (nsectors <= 0)
return -EINVAL;
- sunxi_nand->user_data_bytes = devm_kzalloc(nfc->dev, nsectors,
- GFP_KERNEL);
+ sunxi_nand->user_data_bytes = kzalloc(nsectors, GFP_KERNEL);
if (!sunxi_nand->user_data_bytes)
return -ENOMEM;
@@ -2427,6 +2433,13 @@ static const struct nand_controller_ops sunxi_nand_controller_ops = {
.exec_op = sunxi_nfc_exec_op,
};
+static void sunxi_nand_release(struct nand_chip *chip)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(chip);
+
+ kfree(sunxi_nand);
+}
+
static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc)
{
struct sunxi_nand_chip *sunxi_nand;
@@ -2440,8 +2453,9 @@ static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc)
chip = &sunxi_nand->nand;
ret = mtd_device_unregister(nand_to_mtd(chip));
WARN_ON(ret);
- nand_cleanup(chip);
+ nand_disconnect(chip);
list_del(&sunxi_nand->node);
+ mtd_put_master(nand_to_mtd(chip));
}
}
@@ -2465,8 +2479,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
return -EINVAL;
}
- sunxi_nand = devm_kzalloc(dev, struct_size(sunxi_nand, sels, nsels),
- GFP_KERNEL);
+ sunxi_nand = kzalloc(struct_size(sunxi_nand, sels, nsels), GFP_KERNEL);
if (!sunxi_nand)
return -ENOMEM;
@@ -2477,19 +2490,21 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
if (ret) {
dev_err(dev, "could not retrieve reg property: %d\n",
ret);
- return ret;
+ goto err_free_chip;
}
if (tmp > NFC_MAX_CS) {
dev_err(dev,
"invalid reg value: %u (max CS = 7)\n",
tmp);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_free_chip;
}
if (test_and_set_bit(tmp, &nfc->assigned_cs)) {
dev_err(dev, "CS %d already assigned\n", tmp);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_free_chip;
}
sunxi_nand->sels[i].cs = tmp;
@@ -2518,18 +2533,32 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
ret = nand_scan(nand, nsels);
if (ret)
- return ret;
+ goto err_free_chip;
+
+ ret = nand_set_release(nand, sunxi_nand_release);
+ if (ret)
+ goto err_cleanup_nand;
+ mtd->owner = THIS_MODULE;
ret = mtd_device_register(mtd, NULL, 0);
if (ret) {
dev_err(dev, "failed to register mtd device: %d\n", ret);
- nand_cleanup(nand);
+ nand_disconnect(nand);
+ mtd_put_master(mtd);
return ret;
}
list_add_tail(&sunxi_nand->node, &nfc->chips);
return 0;
+
+err_cleanup_nand:
+ nand_cleanup(nand);
+err_free_chip:
+ /* nand_scan() does not detach a chip whose attach callback failed. */
+ kfree(sunxi_nand->user_data_bytes);
+ kfree(sunxi_nand);
+ return ret;
}
static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc)
@@ -2610,12 +2639,14 @@ static int sunxi_nfc_probe(struct platform_device *pdev)
int irq;
int ret;
- nfc = devm_kzalloc(dev, sizeof(*nfc), GFP_KERNEL);
+ nfc = kzalloc_obj(*nfc);
if (!nfc)
return -ENOMEM;
nfc->dev = dev;
- nand_controller_init(&nfc->controller);
+ ret = devm_nand_controller_init(dev, &nfc->controller, sunxi_nfc_release);
+ if (ret)
+ return ret;
INIT_LIST_HEAD(&nfc->chips);
nfc->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &r);
--
2.53.0
More information about the linux-mtd
mailing list