qcom_spi_ecc_init_ctx_pipelined() installs the ooblayout but never
publishes the ECC context it allocates, so qcom_spi_ooblayout_ecc() and
qcom_spi_ooblayout_free() run against a pointer that describes something
else - a zeroed struct on a first probe, the previous attempt's freed
context on a retry. On IPQ5018 the qcom,smem-part parser makes that retry
routine, and like half the boots on a Mercusys MR80X failed to mount the
rootfs.

Patch 1 is the fix and is unchanged from v1. Patch 2 removes what becomes
redundant once the context is published. It is a cleanup with no
functional change, so it carries no Fixes: tag and is not marked for
stable.

Patch 1 was applied to mtd/fixes as 93bc7c4d2f41 on 2026-09-04 and
dropped the same day, so nothing from this series is queued.

v1: https://lore.kernel.org/all/20260825013848.1056946-1-contact@c127.dev/

Changes in v2:
 - Add Gabor Juhos' Tested-by to patch 1.
 - Add patch 2, dropping the now redundant assignment in
   qcom_spi_ecc_prepare_io_req_pipelined() and the unused zeroed
   struct qpic_ecc allocated in qcom_spi_probe(). Suggested by Gabor
   Juhos, kept separate so the stable backport stays minimal.
 - Rebase onto spi/for-next, which carries commit 44d39535cd4f ("spi:
   spi-qpic-snand: remove interim 'dev_data' variable from
   qcom_spi_probe()") touching the same probe lines as patch 2.

Both patches build with W=1 and sparse without warnings, and each patch
builds on its own.

Johan Alvarado (2):
  spi: spi-qpic-snand: publish the ECC context to snandc->qspi
  spi: spi-qpic-snand: drop the redundant ECC context handling

 drivers/spi/spi-qpic-snand.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)


base-commit: 98100d83adc8e17606605d131e685b1fbedfe092
-- 
2.55.0

On Fri, 11 Sep 2026 13:44:14 -0500, Johan Alvarado wrote:
> spi: spi-qpic-snand: fix the stale ECC context pointer
> 
> qcom_spi_ecc_init_ctx_pipelined() installs the ooblayout but never
> publishes the ECC context it allocates, so qcom_spi_ooblayout_ecc() and
> qcom_spi_ooblayout_free() run against a pointer that describes something
> else - a zeroed struct on a first probe, the previous attempt's freed
> context on a retry. On IPQ5018 the qcom,smem-part parser makes that retry
> routine, and like half the boots on a Mercusys MR80X failed to mount the
> rootfs.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-7.4

Thanks!

[1/2] spi: spi-qpic-snand: publish the ECC context to snandc->qspi
      https://git.kernel.org/broonie/spi/c/f94c9b68bb5f
[2/2] spi: spi-qpic-snand: drop the redundant ECC context handling
      https://git.kernel.org/broonie/spi/c/8d6911645478

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark