mtd: rawnand: brcmnand: Fix crash during the panic_write

commit e66dd317194daae0475fe9e5577c80aa97f16cb9 upstream.

When executing a NAND command within the panic write path, wait for any
pending command instead of calling BUG_ON to avoid crashing while
already crashing.

Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Kursad Oney <kursad.oney@broadcom.com>
Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-4-william.zhang@broadcom.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index d8418d7fcc3728196be4ce1c3b8743d24a836f1e..218782c0f8c08c099acc9b87940cc0b0bedc3a82 100644 (file)
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -1592,7 +1592,17 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
 
        dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
 
-       BUG_ON(ctrl->cmd_pending != 0);
+       /*
+        * If we came here through _panic_write and there is a pending
+        * command, try to wait for it. If it times out, rather than
+        * hitting BUG_ON, just return so we don't crash while crashing.
+        */
+       if (oops_in_progress) {
+               if (ctrl->cmd_pending &&
+                       bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0))
+                       return;
+       } else
+               BUG_ON(ctrl->cmd_pending != 0);
        ctrl->cmd_pending = cmd;
 
        ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);