From nobody Mon Sep 28 17:49:26 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFB77477281; Wed, 19 Aug 2026 14:03:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787148238; cv=none; b=BItfBHfjSwUgLVeWbEXbNFY3GF8HQB2F6PKimNFBCVYJCqAcHmQw42hZjKLkge0o0rDrTtnPVackl750njaGG6Xt2U0zE0uRj4J1NPg37P+M5KopPoMpcNCGe8udyVtvN6r3oAt40krXXbxIzY4XXZmRUAH1AaQPkS8aKW6HDW8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787148238; c=relaxed/simple; bh=gzr9qrQl9Xi6CYbBzzGDgrtxfPAZ72Ttt+Xk8B+5yy0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=EgOCTFpCqkiEG/Jcpy8R7fzTN6GKPXjV7EdIiagnGkGgldm7F5kNuun+JIbFEv08cVOYpdW1NkxfAHQwVDO9rj9ZWjAPKAVdwC4xd2o/Vj/MYi6LP02hjsBTxlSlApZ4RhEg5eDwcVGH7fWJ7uSJBLuEJBDXJiU4g4aNKXGLFas= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=ayrdjv61; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="ayrdjv61" Received: from PC-202605011814.localdomain (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 4a93dedec; Wed, 19 Aug 2026 22:03:47 +0800 (GMT+08:00) From: Runyu Xiao To: Tudor Ambarus Cc: Pratyush Yadav , Michael Walle , Takahiro Kuwano , Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Runyu Xiao , Jianhao Xu Subject: [PATCH v4 1/2] mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive() Date: Wed, 19 Aug 2026 22:03:36 +0800 Message-Id: <20260819140337.36775-2-runyu.xiao@seu.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260819140337.36775-1-runyu.xiao@seu.edu.cn> References: <0a15f6e8-f1ca-4945-9bd5-2b64a2802a58@linaro.org> <20260819140337.36775-1-runyu.xiao@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa01a55d45203a1kunm0db6d2d0140e28 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlDTU9KVh5KTkJNQ0wYTB9NTVYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSEpPSE xVSktLVUpCS0tZBg++ DKIM-Signature: a=rsa-sha256; b=ayrdjv61Na3LInCrwmOcPR3ii9Z02YiD3rL6lpx3+MK79et/zGZ25xqpw0oR1x2SsB9Cuu7QI/kIFz/H9C7LWVnFQXT/PX/c+nndU2yl85LOmK+rA4L+x2j60822tVC1F2quh7fABvLbfIYQQFEzrbW9JMs5rUFEsfaoy8//paQ=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=zGCg9rLuHCXctyeYGSM1cLTpJ4wS8crEseTBz4E8UT0=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" The RWW wait helpers must not block while evaluating the condition. spi_nor_rww_start_exclusive() used mutex_lock() directly and could return with nor->lock still held. Switch the four RWW start helpers to conditional scoped mutex guards so the wait condition never sleeps and nor->lock is released before return. Fixes: 74df43b3f626 ("mtd: spi-nor: Enhance locking to support reads while = writes") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao Changes in v4: - Use the original RWW locking commit in Fixes and update the subject. - Apply the locking fix to all RWW start helpers used as wait conditions. - Keep commit 03e7bb864d9a ("mtd: spi-nor: use scope-based mutex cleanup helpers") as a stable prerequisite because it adds cleanup.h. --- drivers/mtd/spi-nor/core.c | 84 ++++++++++++++++++++------------------ 1 file changed, 45 insertions(+), 39 deletions(-) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index ccf4396cdcd0..d5c6a925862e 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -1273,14 +1273,15 @@ static bool spi_nor_rww_start_io(struct spi_nor *no= r) { struct spi_nor_rww *rww =3D &nor->rww; =20 - guard(mutex)(&nor->lock); - - if (rww->ongoing_io) - return false; + scoped_guard(mutex_try, &nor->lock) { + if (rww->ongoing_io) + return false; =20 - rww->ongoing_io =3D true; + rww->ongoing_io =3D true; + return true; + } =20 - return true; + return false; } =20 static void spi_nor_rww_end_io(struct spi_nor *nor) @@ -1310,16 +1311,17 @@ static bool spi_nor_rww_start_exclusive(struct spi_= nor *nor) { struct spi_nor_rww *rww =3D &nor->rww; =20 - mutex_lock(&nor->lock); - - if (rww->ongoing_io || rww->ongoing_rd || rww->ongoing_pe) - return false; + scoped_guard(mutex_try, &nor->lock) { + if (rww->ongoing_io || rww->ongoing_rd || rww->ongoing_pe) + return false; =20 - rww->ongoing_io =3D true; - rww->ongoing_rd =3D true; - rww->ongoing_pe =3D true; + rww->ongoing_io =3D true; + rww->ongoing_rd =3D true; + rww->ongoing_pe =3D true; + return true; + } =20 - return true; + return false; } =20 static void spi_nor_rww_end_exclusive(struct spi_nor *nor) @@ -1369,23 +1371,25 @@ static bool spi_nor_rww_start_pe(struct spi_nor *no= r, loff_t start, size_t len) u8 first, last; int bank; =20 - guard(mutex)(&nor->lock); + scoped_guard(mutex_try, &nor->lock) { + if (rww->ongoing_io || rww->ongoing_rd || rww->ongoing_pe) + return false; =20 - if (rww->ongoing_io || rww->ongoing_rd || rww->ongoing_pe) - return false; + spi_nor_offset_to_banks(nor->params->bank_size, start, len, + &first, &last); + for (bank =3D first; bank <=3D last; bank++) { + if (rww->used_banks & BIT(bank)) + return false; =20 - spi_nor_offset_to_banks(nor->params->bank_size, start, len, &first, &last= ); - for (bank =3D first; bank <=3D last; bank++) { - if (rww->used_banks & BIT(bank)) - return false; + used_banks |=3D BIT(bank); + } =20 - used_banks |=3D BIT(bank); + rww->used_banks |=3D used_banks; + rww->ongoing_pe =3D true; + return true; } =20 - rww->used_banks |=3D used_banks; - rww->ongoing_pe =3D true; - - return true; + return false; } =20 static void spi_nor_rww_end_pe(struct spi_nor *nor, loff_t start, size_t l= en) @@ -1440,24 +1444,26 @@ static bool spi_nor_rww_start_rd(struct spi_nor *no= r, loff_t start, size_t len) u8 first, last; int bank; =20 - guard(mutex)(&nor->lock); + scoped_guard(mutex_try, &nor->lock) { + if (rww->ongoing_io || rww->ongoing_rd) + return false; =20 - if (rww->ongoing_io || rww->ongoing_rd) - return false; + spi_nor_offset_to_banks(nor->params->bank_size, start, len, + &first, &last); + for (bank =3D first; bank <=3D last; bank++) { + if (rww->used_banks & BIT(bank)) + return false; =20 - spi_nor_offset_to_banks(nor->params->bank_size, start, len, &first, &last= ); - for (bank =3D first; bank <=3D last; bank++) { - if (rww->used_banks & BIT(bank)) - return false; + used_banks |=3D BIT(bank); + } =20 - used_banks |=3D BIT(bank); + rww->used_banks |=3D used_banks; + rww->ongoing_io =3D true; + rww->ongoing_rd =3D true; + return true; } =20 - rww->used_banks |=3D used_banks; - rww->ongoing_io =3D true; - rww->ongoing_rd =3D true; - - return true; + return false; } =20 static void spi_nor_rww_end_rd(struct spi_nor *nor, loff_t start, size_t l= en) --=20 2.34.1 From nobody Mon Sep 28 17:49:26 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE27A4772A4; Wed, 19 Aug 2026 14:03:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787148235; cv=none; b=IpLFhSxG6DneZQMPX9XwkdGl4TEPCenDTcxDropCPkDj/9x9nbLvzvAP7rXHkCF5/GWtCzfIb8wqE7p2kAp+jm/ysn/zux39Tt17Mq6llz3v1t1qGjJ4P8ZsKmA4hfYPqtNU54rEiXobnAbR5qVwQNfzHblrEJHTgiDsFDCoxeE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787148235; c=relaxed/simple; bh=kzNWiLHM/1/Z7GUe8dG0cndFY4pFa401S1+/zmMM9JQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=puhvtVA85QV0W0ujhMV2osmIu/sL/bC8uuR2UmOSRoYqeBMWsyclWjH1T1ScuC+ylsI4ftUvWTOoWHKCMNelSesNVOEua0lCnCJu4K5XLvxN72aD6tuIr1+lNl3JahDDTRmqjMMrNBaoHvLvl0FkfHJ1+A/9pB8jPtYAF8VVkEo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=eyZfHJPA; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="eyZfHJPA" Received: from PC-202605011814.localdomain (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 4a93deded; Wed, 19 Aug 2026 22:03:48 +0800 (GMT+08:00) From: Runyu Xiao To: Tudor Ambarus Cc: Pratyush Yadav , Michael Walle , Takahiro Kuwano , Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Runyu Xiao , Jianhao Xu Subject: [PATCH v4 2/2] mtd: spi-nor: core: Unprepare after interrupted RWW wait Date: Wed, 19 Aug 2026 22:03:37 +0800 Message-Id: <20260819140337.36775-3-runyu.xiao@seu.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260819140337.36775-1-runyu.xiao@seu.edu.cn> References: <0a15f6e8-f1ca-4945-9bd5-2b64a2802a58@linaro.org> <20260819140337.36775-1-runyu.xiao@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa01a55d98003a1kunm0db6d2d0140e2c X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlDTR5MVhlNHhlDSExPGR9MS1YeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSEpPSE xVSktLVUpCS0tZBg++ DKIM-Signature: a=rsa-sha256; b=eyZfHJPA1IC/3LJrlNuQCRVbVAuGSsWmfIeEf2gvORk3JeFrlP66I8OMWCSZA2lDM0veBsbvZLZHgkIkZUfu+A4uj5JlMaeQYaP1kJnkJq2Dcs97DRO8UkSB7LiLGLnaw1La4nvB46J+IaHjPlWYgez+BgLYPSdefsOv8Zt+Y5Y=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=YzavkBzAhnxid9s07HfUC9Bg5vaUt0KhGfcnHKf2bjQ=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" spi_nor_prep_and_lock() calls spi_nor_prep() before waiting. If the wait is interrupted, the controller setup is left active. Call spi_nor_unprep() before returning an error from each helper. Fixes: 74df43b3f626 ("mtd: spi-nor: Enhance locking to support reads while = writes") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao Changes in v4: - Add the cleanup for interrupted RWW waits as a separate patch. - Use the original RWW locking commit in Fixes. --- drivers/mtd/spi-nor/core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c index d5c6a925862e..52264e24eb4b 100644 --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -1348,6 +1348,9 @@ int spi_nor_prep_and_lock(struct spi_nor *nor) ret =3D wait_event_killable(nor->rww.wait, spi_nor_rww_start_exclusive(nor)); =20 + if (ret) + spi_nor_unprep(nor); + return ret; } =20 @@ -1421,6 +1424,9 @@ static int spi_nor_prep_and_lock_pe(struct spi_nor *n= or, loff_t start, size_t le ret =3D wait_event_killable(nor->rww.wait, spi_nor_rww_start_pe(nor, start, len)); =20 + if (ret) + spi_nor_unprep(nor); + return ret; } =20 @@ -1496,6 +1502,9 @@ static int spi_nor_prep_and_lock_rd(struct spi_nor *n= or, loff_t start, size_t le ret =3D wait_event_killable(nor->rww.wait, spi_nor_rww_start_rd(nor, start, len)); =20 + if (ret) + spi_nor_unprep(nor); + return ret; } =20 --=20 2.34.1