kernel/git/stable/linux.git/drivers/mtd/devices, branch master

Merge tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2026-08-23T16:11:21+00:00

Pull mtd updates from Miquel Raynal: "Raw NAND changes: - Sunxi: Support added for the H616 compatible - Qcom: Support added for the MDM9607 compatible - Support for the Toshiba TC58NVG1S3H part - GPMI: New debugfs entry to expose the chip geometry - PL353: Timing updates and software ECC support have been fixed SPI NAND changes: - fmsh: Support added for FM25G{01,02}B chips - HeYangTek: Support added for HYF1GQ4UDACAE Aside from these main changes, there is a high load of misc fixes and hardening changes, and exceptionally no SPI NOR change" * tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits) mtd: rawnand: sunxi: fix H6/H616 controller timings mtd: rawnand: sunxi: describe tADL and tWHR delays mtd: rawnand: sunxi: group controller delay tables mtd: maps: remove dead select of MTD_CFI_BE_BYTE_SWAP mtd: rawnand: gpmi: add debugfs entry for BCH geometry mtd: rawnand: validate ONFI extended parameter page sections mtd: rawnand: sunxi: add H616 MBUS DMA support mtd: spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd: mpc5121_nfc: use platform for irq and ioremap mtd: mtdoops: free page bitmap when the backing MTD is removed mtd: mtdswap: Avoid freeing registered blktrans device twice mtd: afs: validate v2 image info bounds mtd: intel-dg: Fix runtime PM error path in probe mtd: nand-omap2: Move omap_nand_ids[] to raw nand driver mtd: rawnand: add Toshiba TC58NVG1S3H mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() mtd: rawnand: qcom: Add MDM9607 compatible mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2 mtd: rawnand: qcom: Make "aon" clock optional ...

mtd: intel-dg: Fix runtime PM error path in probe

2026-07-17T15:49:13+00:00

intel_dg_mtd_probe() allocates region names before enabling runtime PM and before calling pm_runtime_resume_and_get(). If kasprintf() fails while building a region name, the error path jumps to err, which calls pm_runtime_put(). At that point there has not been a successful pm_runtime_resume_and_get() call to balance, so the runtime PM usage count can underflow. Jump to err_norpm from the kasprintf() failure path, as the runtime PM reference has not been acquired yet. Fixes: 779c59274d03 ("mtd: intel-dg: Fix accessing regions before setting nregions") Signed-off-by: Guangshuo Li Reviewed-by: Raag Jadav Signed-off-by: Miquel Raynal

mtd: mchp23k256: use SPI match data for chip caps

2026-07-03T13:46:01+00:00

The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses of_device_get_match_data(), so a non-OF SPI modalias match falls back to mchp23k256_caps even when the SPI id table selected a different part. Use spi_get_device_match_data() so SPI id-table driver_data is consumed when OF match data is absent. This keeps the existing default fallback while avoiding the wrong MTD geometry for id-table-only matches. Fixes: 4379075a870b ("mtd: mchp23k256: Add support for mchp23lcv1024") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Signed-off-by: Miquel Raynal

mtd: slram: simplify register_device() cleanup

2026-06-11T07:20:39+00:00

Use local variables for the list entry, mtd_info, and private data while initializing a new device. This keeps the initialization path easier to read and publishes the new list entry only after mtd_device_register() has succeeded. Signed-off-by: Ruoyu Wang Signed-off-by: Miquel Raynal

mtd: slram: remove failed entries from the device list

2026-06-11T07:20:39+00:00

register_device() links a new slram_mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the global list. A later cleanup can then dereference or free invalid state from that failed entry. Unwind the partially initialized entry and clear the list tail on each failure path after the entry has been linked. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Ruoyu Wang Signed-off-by: Miquel Raynal

mtd: docg3: fix use-after-free in docg3_release()

2026-03-11T15:24:10+00:00

In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable. Fixes: c8ae3f744ddc ("lib/bch: Rework a little bit the exported function names") Cc: stable@vger.kernel.org Signed-off-by: James Kim Signed-off-by: Miquel Raynal

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This is the exact same thing as the 'alloc_obj()' version, only much smaller because there are a lot fewer users of the *alloc_flex() interface. As with alloc_obj() version, this was done entirely with mindless brute force, using the same script, except using 'flex' in the pattern rather than 'objs*'. Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

mtd: intel-dg: Fix accessing regions before setting nregions

2026-01-19T10:49:21+00:00

The regions array is counted by nregions, but it's set only after accessing it: [] UBSAN: array-index-out-of-bounds in drivers/mtd/devices/mtd_intel_dg.c:750:15 [] index 0 is out of range for type ' [*]' Fix it by also fixing an undesired behavior: the loop silently ignores ENOMEM and continues setting the other entries. CC: Gustavo A. R. Silva CC: Raag Jadav Reported-by: Jani Partanen Closes: https://lore.kernel.org/all/caca6c67-4f1d-49f1-948f-e63b6b937b29@sotapeli.fi Fixes: ceb5ab3cb646 ("mtd: add driver for intel graphics non-volatile memory device") Signed-off-by: Lucas De Marchi Signed-off-by: Alexander Usyskin Reviewed-by: Raag Jadav Signed-off-by: Miquel Raynal