mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations

PATCH Superseded [email protected] 4 participants 7 messages Jul 9, 2025 – Jul 16, 2025 1 message not in the archive

Subsystems (2)

Memory technology devices (MTD) SPI NOR

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

[email protected]

author

2025-07-09 01:30 UTC #1 lore raw

PATCH 1/1 mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations

From: kromli <[email protected]>

Ensure that the pointer passed to module_put() in spi_nor_put_device() is not NULL before use. This change adds a guard clause to return early, preventing the kernel crash below when the cadence-qspi driver is removed during a dd operation:

[  200.448732] Unable to handle kernel NULL pointer deref
erence at virtual address 0000000000000010
[  200.457576] Mem abort info:
[  200.460370]   ESR = 0x0000000096000004
[  200.464136]   EC = 0x25: DABT (current EL), IL = 32 bits
[  200.469527]   SET = 0, FnV = 0
[  200.472609]   EA = 0, S1PTW = 0
[  200.475904]   FSC = 0x04: level 0 translation fault
[  200.480786] Data abort info:
[  200.483659]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  200.489141]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  200.494189]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  200.499500] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000185df8000
[  200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
[  200.512720] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  200.518968] Modules linked in: 8021q garp mrp stp llc bluetooth ecdh_generic
ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
_fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6
[  200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
c4179a6 #1
[  200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
[  200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  200.560234] pc : spi_nor_put_device+0x30/0x60
[  200.564594] lr : __put_mtd_device+0x8c/0x120
[  200.568856] sp : ffff80008411bc20
[  200.572161] x29: ffff80008411bc20 x28: ffff000185e2c500 x27: 0000000000000000
[  200.579282] x26: 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88
[  200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21: ffff00018873e080
[  200.593524] x20: 0000000000000000 x19: ffff00018873e080 x18: ffffffffffffffff
[  200.600645] x17: 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700
[  200.607767] x14: 0000000000000000 x13: ffff000180045010 x12: ffff0001857576c0
[  200.614888] x11: 000000000000003a x10: ffff000180045018 x9 : ffff000180045010
[  200.622009] x8 : ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048
[  200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 : 0000000000000000
[  200.636250] x2 : 0000000000000000 x1 : ffff00018873e080 x0 : 0000000000000000
[  200.643371] Call trace:
[  200.645811]  spi_nor_put_device+0x30/0x60
[  200.649816]  __put_mtd_device+0x8c/0x120
[  200.653731]  put_mtd_device+0x30/0x48
[  200.657387]  mtdchar_close+0x30/0x78
[  200.660958]  __fput+0xc8/0x2d0
[  200.664011]  ____fput+0x14/0x20
[  200.667146]  task_work_run+0x70/0xdc
[  200.670718]  do_exit+0x2b4/0x8e4
[  200.673944]  do_group_exit+0x34/0x90
[  200.677512]  pid_child_should_wake+0x0/0x60
[  200.681686]  invoke_syscall+0x48/0x104
[  200.685432]  el0_svc_common.constprop.0+0xc0/0xe0
[  200.690128]  do_el0_svc+0x1c/0x28
[  200.693439]  el0_svc+0x30/0xcc
[  200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency
[  200.696485]  el0t_64_sync_handler+0x120/0x12c
[  200.706552]  el0t_64_sync+0x190/0x194
[  200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800)
[  200.716290] ---[ end trace 0000000000000000 ]---
[  200.720948] Fixing recursive fault but reboot is needed!

Fixes be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing resources during read/write")

CC [email protected] # 6.12+

Signed-off-by Khairul Anuar Romli <[email protected]>

Reviewed-by Matthew Gerlach <[email protected]>

---
 drivers/mtd/spi-nor/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/mtd/spi-nor/core.c +5 -1

index ac4b960101cc..501e48a342ad 100644
@@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info *mtd)
 	if (!try_module_get(dev->driver->owner))
 		return -ENODEV;
 
+	if (!dev && !dev->driver && !dev->driver->owner)
+		return -EINVAL;
+
 	return 0;
 }

@@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info *mtd)
 	else
 		dev = nor->dev;
 
-	module_put(dev->driver->owner);
+	if (dev && dev->driver && dev->driver->owner)
+		module_put(dev->driver->owner);
 }
 
 static void spi_nor_restore(struct spi_nor *nor)

Signature · 1 line

2.35.3

Matthew Gerlach

2025-07-09 01:34 UTC #2 lore raw

Quoted 6 lines · On 7/8/25 6:30 PM, [email protected] wrote:

From: kromli <[email protected]>
Ensure that the pointer passed to module_put() in spi_nor_put_device() is not NULL before use. This change adds a guard clause to return early, preventing the kernel crash below when the cadence-qspi driver is removed during a dd operation:

Let's get this submitted!

Quoted 90 lines

[  200.448732] Unable to handle kernel NULL pointer deref
erence at virtual address 0000000000000010
[  200.457576] Mem abort info:
[  200.460370]   ESR = 0x0000000096000004
[  200.464136]   EC = 0x25: DABT (current EL), IL = 32 bits
[  200.469527]   SET = 0, FnV = 0
[  200.472609]   EA = 0, S1PTW = 0
[  200.475904]   FSC = 0x04: level 0 translation fault
[  200.480786] Data abort info:
[  200.483659]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  200.489141]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  200.494189]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  200.499500] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000185df8000
[  200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
[  200.512720] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  200.518968] Modules linked in: 8021q garp mrp stp llc bluetooth ecdh_generic
ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
_fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6
[  200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
c4179a6 #1
[  200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
[  200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  200.560234] pc : spi_nor_put_device+0x30/0x60
[  200.564594] lr : __put_mtd_device+0x8c/0x120
[  200.568856] sp : ffff80008411bc20
[  200.572161] x29: ffff80008411bc20 x28: ffff000185e2c500 x27: 0000000000000000
[  200.579282] x26: 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88
[  200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21: ffff00018873e080
[  200.593524] x20: 0000000000000000 x19: ffff00018873e080 x18: ffffffffffffffff
[  200.600645] x17: 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700
[  200.607767] x14: 0000000000000000 x13: ffff000180045010 x12: ffff0001857576c0
[  200.614888] x11: 000000000000003a x10: ffff000180045018 x9 : ffff000180045010
[  200.622009] x8 : ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048
[  200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 : 0000000000000000
[  200.636250] x2 : 0000000000000000 x1 : ffff00018873e080 x0 : 0000000000000000
[  200.643371] Call trace:
[  200.645811]  spi_nor_put_device+0x30/0x60
[  200.649816]  __put_mtd_device+0x8c/0x120
[  200.653731]  put_mtd_device+0x30/0x48
[  200.657387]  mtdchar_close+0x30/0x78
[  200.660958]  __fput+0xc8/0x2d0
[  200.664011]  ____fput+0x14/0x20
[  200.667146]  task_work_run+0x70/0xdc
[  200.670718]  do_exit+0x2b4/0x8e4
[  200.673944]  do_group_exit+0x34/0x90
[  200.677512]  pid_child_should_wake+0x0/0x60
[  200.681686]  invoke_syscall+0x48/0x104
[  200.685432]  el0_svc_common.constprop.0+0xc0/0xe0
[  200.690128]  do_el0_svc+0x1c/0x28
[  200.693439]  el0_svc+0x30/0xcc
[  200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency
[  200.696485]  el0t_64_sync_handler+0x120/0x12c
[  200.706552]  el0t_64_sync+0x190/0x194
[  200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800)
[  200.716290] ---[ end trace 0000000000000000 ]---
[  200.720948] Fixing recursive fault but reboot is needed!

Fixes be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing resources during read/write")

CC [email protected] # 6.12+

Signed-off-by Khairul Anuar Romli <[email protected]>

Reviewed-by Matthew Gerlach <[email protected]>

---
  drivers/mtd/spi-nor/core.c | 6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)

drivers/mtd/spi-nor/core.c +5 -1

index ac4b960101cc..501e48a342ad 100644
@@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info *mtd)
  	if (!try_module_get(dev->driver->owner))
  		return -ENODEV;
 
+	if (!dev && !dev->driver && !dev->driver->owner)
+		return -EINVAL;
+
  	return 0;
  }

@@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info *mtd)
  	else
  		dev = nor->dev;
 
-	module_put(dev->driver->owner);
+	if (dev && dev->driver && dev->driver->owner)
+		module_put(dev->driver->owner);
  }
 
  static void spi_nor_restore(struct spi_nor *nor)

Michael Walle

maintainer

2025-07-09 14:39 UTC #3 lore raw

In reply to [email protected]

Hi,

Quoted 85 lines

[  200.448732] Unable to handle kernel NULL pointer deref
erence at virtual address 0000000000000010
[  200.457576] Mem abort info:
[  200.460370]   ESR = 0x0000000096000004
[  200.464136]   EC = 0x25: DABT (current EL), IL = 32 bits
[  200.469527]   SET = 0, FnV = 0
[  200.472609]   EA = 0, S1PTW = 0
[  200.475904]   FSC = 0x04: level 0 translation fault
[  200.480786] Data abort info:
[  200.483659]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  200.489141]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  200.494189]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  200.499500] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000185df8000
[  200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
[  200.512720] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  200.518968] Modules linked in: 8021q garp mrp stp llc bluetooth ecdh_generic
ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of
_fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6
[  200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
c4179a6 #1
[  200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
[  200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  200.560234] pc : spi_nor_put_device+0x30/0x60
[  200.564594] lr : __put_mtd_device+0x8c/0x120
[  200.568856] sp : ffff80008411bc20
[  200.572161] x29: ffff80008411bc20 x28: ffff000185e2c500 x27: 0000000000000000
[  200.579282] x26: 0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88
[  200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21: ffff00018873e080
[  200.593524] x20: 0000000000000000 x19: ffff00018873e080 x18: ffffffffffffffff
[  200.600645] x17: 0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700
[  200.607767] x14: 0000000000000000 x13: ffff000180045010 x12: ffff0001857576c0
[  200.614888] x11: 000000000000003a x10: ffff000180045018 x9 : ffff000180045010
[  200.622009] x8 : ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048
[  200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 : 0000000000000000
[  200.636250] x2 : 0000000000000000 x1 : ffff00018873e080 x0 : 0000000000000000
[  200.643371] Call trace:
[  200.645811]  spi_nor_put_device+0x30/0x60
[  200.649816]  __put_mtd_device+0x8c/0x120
[  200.653731]  put_mtd_device+0x30/0x48
[  200.657387]  mtdchar_close+0x30/0x78
[  200.660958]  __fput+0xc8/0x2d0
[  200.664011]  ____fput+0x14/0x20
[  200.667146]  task_work_run+0x70/0xdc
[  200.670718]  do_exit+0x2b4/0x8e4
[  200.673944]  do_group_exit+0x34/0x90
[  200.677512]  pid_child_should_wake+0x0/0x60
[  200.681686]  invoke_syscall+0x48/0x104
[  200.685432]  el0_svc_common.constprop.0+0xc0/0xe0
[  200.690128]  do_el0_svc+0x1c/0x28
[  200.693439]  el0_svc+0x30/0xcc
[  200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency
[  200.696485]  el0t_64_sync_handler+0x120/0x12c
[  200.706552]  el0t_64_sync+0x190/0x194
[  200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800)
[  200.716290] ---[ end trace 0000000000000000 ]---
[  200.720948] Fixing recursive fault but reboot is needed!

Fixes be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing resources during read/write")

CC [email protected] # 6.12+

Signed-off-by Khairul Anuar Romli <[email protected]>

Reviewed-by Matthew Gerlach <[email protected]>

---
 drivers/mtd/spi-nor/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/mtd/spi-nor/core.c +3 -0

index ac4b960101cc..501e48a342ad 100644
@@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info *mtd)
 	if (!try_module_get(dev->driver->owner))
 		return -ENODEV;
 
+	if (!dev && !dev->driver && !dev->driver->owner)
+		return -EINVAL;
+
 	return 0;
 }

drivers/mtd/spi-nor/core.c static void spi_nor_put_device(struct mtd_info *mtd) · line 3234

Quoted 6 lines

drivers/mtd/spi-nor/core.c +2 -1

@@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info *mtd)
 	else
 		dev = nor->dev;
 
-	module_put(dev->driver->owner);
+	if (dev && dev->driver && dev->driver->owner)
+		module_put(dev->driver->owner);

Why is dev->driver or dev->driver->owner NULL in the first place?

-michael

Romli, Khairul Anuar

author

2025-07-15 07:53 UTC #4 lore raw

Quoted 97 lines

From: Michael Walle <[email protected]>
Hi,
Quoted 17 lines
Ensure that the pointer passed to module_put() in spi_nor_put_device() is not NULL before use. This change adds a guard clause to return early, preventing the kernel crash below when the cadence-qspi driver is removed during a dd operation:
[  200.448732] Unable to handle kernel NULL pointer deref erence at
virtual address 0000000000000010 [  200.457576] Mem abort info:
[  200.460370]   ESR = 0x0000000096000004
[  200.464136]   EC = 0x25: DABT (current EL), IL = 32 bits
[  200.469527]   SET = 0, FnV = 0
[  200.472609]   EA = 0, S1PTW = 0
[  200.475904]   FSC = 0x04: level 0 translation fault
[  200.480786] Data abort info:
[  200.483659]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  200.489141]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  200.494189]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  200.499500] user pgtable: 4k pages, 48-bit VAs,
Quoted 2 lines
pgdp=0000000185df8000 [ 200.505932] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 [ 200.512720]
Internal
Quoted 1 line
error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 200.518968]
Modules
Quoted 7 lines
linked in: 8021q garp mrp stp llc bluetooth ecdh_generic ecc rfkill crct10dif_ce rtc_ds1307 at24 stratix10_soc soc64_hwmon gpio_altera of _fpga_region fpga_region fpga_bridge uio_pdrv_genirq uio fuse drm backlight ipv6 [ 200.540016] CPU: 0 UID: 0 PID: 372 Comm: dd Not tainted 6.12.19-altera-gb6b26
c4179a6 #1
[  200.547996] Hardware name: SoCFPGA Stratix 10 SoCDK (DT) [
Quoted 15 lines
200.553292] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 200.560234] pc : spi_nor_put_device+0x30/0x60 [ 200.564594] lr : __put_mtd_device+0x8c/0x120 [ 200.568856] sp :
ffff80008411bc20 [ 200.572161] x29: ffff80008411bc20 x28:
ffff000185e2c500 x27: 0000000000000000 [ 200.579282] x26:
0000000000000000 x25: ffff000185e2cb00 x24: ffff000185e2cc88 [ 200.586404] x23: ffff00018034c620 x22: 0000000000000001 x21:
ffff00018873e080 [ 200.593524] x20: 0000000000000000 x19:
ffff00018873e080 x18: ffffffffffffffff [ 200.600645] x17:
0030393d524f4a41 x16: 4d0064746d3d4d45 x15: ffff000185757700 [ 200.607767] x14: 0000000000000000 x13: ffff000180045010 x12:
ffff0001857576c0 [ 200.614888] x11: 000000000000003a x10:
ffff000180045018 x9 : ffff000180045010 [ 200.622009] x8 :
ffff80008411bb70 x7 : 0000000000000000 x6 : ffff000181325048 [ 200.629129] x5 : 00000000820001cf x4 : fffffdffc60095e0 x3 :
0000000000000000 [ 200.636250] x2 : 0000000000000000 x1 :
ffff00018873e080 x0 : 0000000000000000 [ 200.643371] Call trace:
Quoted 2 lines
[  200.645811]  spi_nor_put_device+0x30/0x60 [  200.649816]
__put_mtd_device+0x8c/0x120 [ 200.653731]
put_mtd_device+0x30/0x48 [
> 200.657387]  mtdchar_close+0x30/0x78 [  200.660958]
__fput+0xc8/0x2d0
> [  200.664011]  ____fput+0x14/0x20 [  200.667146]
> task_work_run+0x70/0xdc [  200.670718]  do_exit+0x2b4/0x8e4 [
> 200.673944]  do_group_exit+0x34/0x90 [  200.677512]
> pid_child_should_wake+0x0/0x60 [  200.681686]
> invoke_syscall+0x48/0x104 [  200.685432]
> el0_svc_common.constprop.0+0xc0/0xe0
> [  200.690128]  do_el0_svc+0x1c/0x28
> [  200.693439]  el0_svc+0x30/0xcc
drivers/mtd/spi-nor/core.c static int spi_nor_get_device(struct mtd_info
Quoted 21 lines
[  200.696454] dw_mmc ff808000.mmc: Unexpected interrupt latency [
200.696485] el0t_64_sync_handler+0x120/0x12c [ 200.706552] el0t_64_sync+0x190/0x194 [ 200.710213] Code: f9400000 f9417c00 f9402000 f9403400 (f9400800) [ 200.716290] ---[ end trace 0000000000000000 ]--- [ 200.720948] Fixing recursive fault but reboot is needed!
Fixes be94215be1ab ("mtd: spi-nor: core: Fix an issue of releasing
resources during read/write")
CC [email protected] # 6.12+
Signed-off-by Khairul Anuar Romli <[email protected]>
Reviewed-by Matthew Gerlach <[email protected]>
---
 drivers/mtd/spi-nor/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mtd/spi-nor/core.c +0 -0
index ac4b960101cc..501e48a342ad 100644
@@ -3213,6 +3213,9 @@ static int spi_nor_get_device(struct mtd_info
*mtd)
drivers/mtd/spi-nor/core.c static void spi_nor_put_device(struct mtd_info
Quoted 10 lines
drivers/mtd/spi-nor/core.c +3 -0
      if (!try_module_get(dev->driver->owner))
              return -ENODEV;
 
+     if (!dev && !dev->driver && !dev->driver->owner)
+             return -EINVAL;
+
      return 0;
 }
 
@@ -3227,7 +3230,8 @@ static void spi_nor_put_device(struct mtd_info
*mtd)

Quoted 8 lines

drivers/mtd/spi-nor/core.c static void spi_nor_put_device(struct mtd_info *mtd) · line 3234
Quoted 6 lines
drivers/mtd/spi-nor/core.c +2 -1
      else
              dev = nor->dev;
 
-     module_put(dev->driver->owner);
+     if (dev && dev->driver && dev->driver->owner)
+             module_put(dev->driver->owner);
Why is dev->driver or dev->driver->owner NULL in the first place?

When we remove/unbind the the spi node during busy, we will hit with dev->driver and dev->driver->owner NULL derefence. This eventually leads to the oops that I included in the commit message body.

Quoted 2 lines

-michael

Michael Walle

maintainer

2025-07-16 06:46 UTC #5 lore raw

Hi,

Quoted 8 lines · Khairul Anuar Romli

Quoted 5 lines
drivers/mtd/spi-nor/core.c static void spi_nor_put_device(struct mtd_info *mtd) · line 3234
Quoted 3 lines
drivers/mtd/spi-nor/core.c +2 -1
-     module_put(dev->driver->owner);
+     if (dev && dev->driver && dev->driver->owner)
+             module_put(dev->driver->owner);
Why is dev->driver or dev->driver->owner NULL in the first place?
When we remove/unbind the the spi node during busy, we will hit with dev->driver and dev->driver->owner NULL derefence.

Yes, but my question was why is this the case? I.e. why is dev or dev->driver NULL?

-michael

Dan Carpenter

2025-07-14 19:29 UTC #6 lore raw

In reply to [email protected]

Hi,

kernel test robot noticed the following build warnings:

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/khairul-anuar-romli-altera-com/mtd-spi-nor-core-Prevent-oops-during-driver-removal-with-active-read-or-write-operations/20250709-103107
base:   https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git spi-nor/next
patch link:    https://lore.kernel.org/r/e439e6b85e650a91607a1d02d5d432d096363315.1752024352.git.khairul.anuar.romli%40altera.com
patch subject: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
config: i386-randconfig-141-20250711 (https://download.01.org/0day-ci/archive/20250711/[email protected]/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags

| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable dereferenced before check 'dev' (see line 3213) drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable dereferenced before check 'dev->driver' (see line 3213)

vim +/dev +3216 drivers/mtd/spi-nor/core.c

be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3202  static int spi_nor_get_device(struct mtd_info *mtd)
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3203  {
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3204  	struct mtd_info *master = mtd_get_master(mtd);
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3205  	struct spi_nor *nor = mtd_to_spi_nor(master);
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3206  	struct device *dev;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3207  
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3208  	if (nor->spimem)
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3209  		dev = nor->spimem->spi->controller->dev.parent;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3210  	else
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3211  		dev = nor->dev;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3212  
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01 @3213  	if (!try_module_get(dev->driver->owner))
                                                                                                    ^^^^^^^^^^^^^^^^^^

Dereference

be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3214  		return -ENODEV;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3215  
240522762fc4bc drivers/mtd/spi-nor/core.c    kromli     2025-07-09 @3216  	if (!dev && !dev->driver && !dev->driver->owner)
                                                                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

These checks are done too late. Also missing module put.

240522762fc4bc drivers/mtd/spi-nor/core.c    kromli     2025-07-09  3217  		return -EINVAL;
240522762fc4bc drivers/mtd/spi-nor/core.c    kromli     2025-07-09  3218  
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3219  	return 0;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3220  }

Signature · 2 lines

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Romli, Khairul Anuar

author

2025-07-15 00:15 UTC #7 lore raw

Quoted 137 lines

From: Dan Carpenter <[email protected]>
Sent: Tuesday, 15 July, 2025 3:30 AM
To: [email protected]; Romli, Khairul Anuar <[email protected]>; Tudor Ambarus <[email protected]>; Pratyush Yadav <[email protected]>; Michael Walle <[email protected]>; Miquel Raynal <[email protected]>; Richard Weinberger <[email protected]>; Vignesh Raghavendra <[email protected]>; open list:SPI NOR SUBSYSTEM <[email protected]>; open list <[email protected]>; Gerlach, Matthew <[email protected]>
Cc: [email protected]; [email protected]
Subject: Re: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
Hi,
kernel test robot noticed the following build warnings:
https://git-/
scm.com%2Fdocs%2Fgit-format- patch%23_base_tree_information&data=05%7C02%7Ckhairul.anuar.romli%4 0altera.com%7Cf6c3b8bb5b844138259308ddc30cd2ae%7Cfbd72e03d4a54 110adce614d51f2077a%7C0%7C0%7C638881182091182847%7CUnknow n%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIl AiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sd ata=eR42SdwIvE8%2BT3uUpe1WKz%2Fn0V4DNnLHExb1IPi1Gas%3D&reserv ed=0]
url:
https://gith/
ub.com%2Fintel-lab-lkp%2Flinux%2Fcommits%2Fkhairul-anuar-romli-altera- com%2Fmtd-spi-nor-core-Prevent-oops-during-driver-removal-with-active- read-or-write-operations%2F20250709- 103107&data=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb 5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f2077a% 7C0%7C0%7C638881182091208992%7CUnknown%7CTWFpbGZsb3d8eyJF bXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT WFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=KJm%2FUt2CNwr3J2 Gsoxd2oe36gitqmmby3df73UWsZHo%3D&reserved=0
base:
https://git.k/
ernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Fmtd%2Flinux.git&dat a=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb5b8441382 59308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f2077a%7C0%7C0% 7C638881182091223786%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hc GkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIld UIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=u3%2FCugi1Z%2BobMTJu5qWFj 4tkjYr%2FgC4PGVt0NJvAktA%3D&reserved=0 spi-nor/next
patch link:
https://lore/.
kernel.org%2Fr%2Fe439e6b85e650a91607a1d02d5d432d096363315.1752 024352.git.khairul.anuar.romli%2540altera.com&data=05%7C02%7Ckhairul. anuar.romli%40altera.com%7Cf6c3b8bb5b844138259308ddc30cd2ae%7C fbd72e03d4a54110adce614d51f2077a%7C0%7C0%7C6388811820912375 62%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLj AuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0% 7C%7C%7C&sdata=sy%2BIZORvA8IgYI5BZsHEQgoIH9wKyndszhYwQ6N7vzw %3D&reserved=0
patch subject: [PATCH 1/1] mtd: spi-nor: core: Prevent oops during driver removal with active read or write operations
config: i386-randconfig-141-20250711
(https://do/
wnload.01.org%2F0day- ci%2Farchive%2F20250711%2F202507110922.btkgvYrn- lkp%40intel.com%2Fconfig&data=05%7C02%7Ckhairul.anuar.romli%40altera .com%7Cf6c3b8bb5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110ad ce614d51f2077a%7C0%7C0%7C638881182091250946%7CUnknown%7CT WFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJX aW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=zvj oJvmjeQnS7dTajwXbAB6GiqNwecZtS3win3Sv7lM%3D&reserved=0)
compiler: clang version 20.1.8
(https://gith/
ub.com%2Fllvm%2Fllvm- project&data=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb 5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f2077a% 7C0%7C0%7C638881182091264782%7CUnknown%7CTWFpbGZsb3d8eyJF bXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT WFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=FYcm8fzKMhihgW5At oVRcGTCV56qKYNlx3uJpT%2B4DPo%3D&reserved=0 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes:
|
https://lore/
| .kernel.org%2Fr%2F202507110922.btkgvYrn- lkp%40intel.com%2F&data=05%7C0
| 2%7Ckhairul.anuar.romli%40altera.com%7Cf6c3b8bb5b844138259308ddc3 0cd2a
| e%7Cfbd72e03d4a54110adce614d51f2077a%7C0%7C0%7C638881182091 278235%7CUn
| known%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAw MCIsIlAiOi
| JXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata= NMmQgJov
| ArDDW9sbKYrmIdl3lTRLvDD2SNq10pYeQ9s%3D&reserved=0
smatch warnings:
drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable dereferenced before check 'dev' (see line 3213) drivers/mtd/spi-nor/core.c:3216 spi_nor_get_device() warn: variable dereferenced before check 'dev->driver' (see line 3213)
vim +/dev +3216 drivers/mtd/spi-nor/core.c
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3202
static int spi_nor_get_device(struct mtd_info *mtd)
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3203
{
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3204
      struct mtd_info *master = mtd_get_master(mtd);
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3205
      struct spi_nor *nor = mtd_to_spi_nor(master);
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3206
      struct device *dev;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3207
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3208
      if (nor->spimem)
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3209
              dev = nor->spimem->spi->controller->dev.parent;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3210
      else
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3211
              dev = nor->dev;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3212
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01
@3213         if (!try_module_get(dev->driver->owner))
                                                                                                    ^^^^^^^^^^^^^^^^^^
Dereference

Quoted 8 lines

be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3214
              return -ENODEV;
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3215
240522762fc4bc drivers/mtd/spi-nor/core.c    kromli     2025-07-09 @3216
      if (!dev && !dev->driver && !dev->driver->owner)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ These checks are done too late. Also missing module put.

I will send the v2 revision to fix this. I don't think we need module put. Module put Will cause the kernel oops if any of the nodes are null.

Quoted 19 lines

240522762fc4bc drivers/mtd/spi-nor/core.c kromli 2025-07-09 3217
              return -EINVAL;
240522762fc4bc drivers/mtd/spi-nor/core.c    kromli     2025-07-09  3218
be94215be1ab19 drivers/mtd/spi-nor/core.c    Xiang Chen 2021-04-01  3219
      return 0;
be94215be1ab19 drivers/mtd/spi-nor/core.c Xiang Chen 2021-04-01 3220
}
--
0-DAY CI Kernel Test Service
https://gith/
ub.com%2Fintel%2Flkp- tests%2Fwiki&data=05%7C02%7Ckhairul.anuar.romli%40altera.com%7Cf6c3 b8bb5b844138259308ddc30cd2ae%7Cfbd72e03d4a54110adce614d51f20 77a%7C0%7C0%7C638881182091292007%7CUnknown%7CTWFpbGZsb3d 8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkF OIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=SSQX73%2Bm m3Eqb6XaYih3tHM7sL5d%2Fuodt3DggYXTBNc%3D&reserved=0