kernel/git/next/linux-next.git/drivers/mtd/chips, branch master

mtd: cfi_cmdset_0001: shrink do_write_buffer() stack frame

2026-09-04T17:13:21+00:00

arm32 allmodconfig fails to build with gcc: drivers/mtd/chips/cfi_cmdset_0001.c:1883:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] With MTD_MAP_BANK_WIDTH_32 a map_word is 32 bytes, and with KASAN_STACK every temporary gets its own redzoned slot. do_write_buffer() builds a map_word for each of the twelve commands it issues, and those temporaries dominate its frame. Issue the commands through a small noinline helper that takes the command as a plain value and builds the map_word in its own frame. The sequence of reads and writes to the chip is unchanged. The helper must not be inlined, and reusing one map_word local is not enough: clang cannot assume the callee does not observe the local, so it still returns each CMD() into a per-call-site temporary, and the frame grows (1760 -> 1824 bytes in cfi_intelext_writev(), into which clang inlines do_write_buffer()). Frame sizes with MTD_MAP_BANK_WIDTH_32 and KASAN_STACK: gcc 15.2 do_write_buffer() 1296 -> 520 clang 21 cfi_intelext_writev() 1760 -> 896 The helper itself takes 168 (gcc) / 160 (clang) bytes. Reported-by: Andy Shevchenko Closes: https://lore.kernel.org/all/20260408211407.2295175-1-andriy.shevchenko@linux.intel.com/ Suggested-by: Miquel Raynal Link: https://lore.kernel.org/all/87ik9cfm6g.fsf@bootlin.com/ Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Miquel Raynal

mtd: cfi_cmdset_0001: silence spurious suspend warning on shutdown

2026-06-29T14:37:03+00:00

cfi_intelext_reboot() puts each chip into FL_SHUTDOWN (array mode) via the reboot notifier so the bootloader can read the flash on the next boot. If pm_suspend then runs on the same chip during the shutdown sequence, cfi_intelext_suspend() falls into the default branch and prints: Flash device refused suspend due to active operation (state 20) The chip is not active; it is already shut down. Treat FL_SHUTDOWN the same as FL_PM_SUSPENDED in the suspend switch so nothing is done and no warning is emitted. Reproduced on every boot of the QEMU 'virt' arm64 machine, which exposes two Intel-Sharp pflash chips. Signed-off-by: Breno Leitao Signed-off-by: Miquel Raynal

mtd: cfi: Use common error handling code in two functions

2026-06-11T07:20:50+00:00

Use additional labels so that a bit of exception handling can be better reused at the end of two function implementations. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Miquel Raynal

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22T16:26:33+00:00

Conversion performed via this Coccinelle script: // SPDX-License-Identifier: GPL-2.0-only // Options: --include-headers-for-types --all-includes --include-headers --keep-comments virtual patch @gfp depends on patch && !(file in "tools") && !(file in "samples")@ identifier ALLOC = {kmalloc_obj,kmalloc_objs,kmalloc_flex, kzalloc_obj,kzalloc_objs,kzalloc_flex, kvmalloc_obj,kvmalloc_objs,kvmalloc_flex, kvzalloc_obj,kvzalloc_objs,kvzalloc_flex}; @@ ALLOC(... - , GFP_KERNEL ) $ make coccicheck MODE=patch COCCI=gfp.cocci Build and boot tested x86_64 with Fedora 42's GCC and Clang: Linux version 6.19.0+ (user@host) (gcc (GCC) 15.2.1 20260123 (Red Hat 15.2.1-7), GNU ld version 2.44-12.fc42) #1 SMP PREEMPT_DYNAMIC 1970-01-01 Linux version 6.19.0+ (user@host) (clang version 20.1.8 (Fedora 20.1.8-4.fc42), LLD 20.1.8) #1 SMP PREEMPT_DYNAMIC 1970-01-01 Signed-off-by: Kees Cook Signed-off-by: Linus Torvalds

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-22T04:03:00+00:00

This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This is the exact same thing as the 'alloc_obj()' version, only much smaller because there are a lot fewer users of the *alloc_flex() interface. As with alloc_obj() version, this was done entirely with mindless brute force, using the same script, except using 'flex' in the pattern rather than 'objs*'. Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking

2026-01-22T14:07:39+00:00

UBSAN reports shift-out-of-bounds in jedec_read_mfr() and jedec_read_id(): UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1924:13 shift exponent 32 is too large for 32-bit type 'int' UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1940:12 shift exponent 32 is too large for 32-bit type 'int' The JEDEC manufacturer/device ID masking uses: (1 << (cfi->device_type * 8)) - 1 When cfi->device_type is 4, this evaluates to 1 << 32. Since the literal '1' has type int, this is a 32-bit shift and is undefined behavior. Fix it by using a 64-bit literal (1ULL) so the shift is performed in a 64-bit type. Co-developed-by: Hui Peng Signed-off-by: Hui Peng Co-developed-by: Zhihao Yao (Zephyr) Signed-off-by: Zhihao Yao (Zephyr) Signed-off-by: Chenxi Hou Signed-off-by: Miquel Raynal

mtd: jedec_probe: use struct_size() helper for cfiq allocation

2025-09-29T16:01:43+00:00

Documentation/process/deprecated.rst recommends against performing dynamic size calculations in the arguments of memory allocator functions due to the risk of overflow. Such calculations can wrap around and result in a smaller allocation than expected. Replace the size calculation in cfiq allocation with struct_size() helper to make the code clearer and handle overflows correctly. Signed-off-by: Rahul Kumar Signed-off-by: Miquel Raynal