mtd: rawnand: stm32_fmc2: fix ECC overwrite

commit 811c0da4542df3c065f6cb843ced68780e27bb44 upstream.

In case OOB write is requested during a data write, ECC is currently
lost. Avoid this issue by only writing in the free spare area.
This issue has been seen with a YAFFS2 file system.

Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com>
Cc: stable@vger.kernel.org
Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mtd/nand/raw/stm32_fmc2_nand.c b/drivers/mtd/nand/raw/stm32_fmc2_nand.c
index 21b0ebb0af43c694a402157efb1fe7f9410aaed6..7488a496950291755c1ef41165905054987bf9bd 100644 (file)
--- a/drivers/mtd/nand/raw/stm32_fmc2_nand.c
+++ b/drivers/mtd/nand/raw/stm32_fmc2_nand.c
@@ -985,9 +985,21 @@ static int stm32_fmc2_nfc_seq_write(struct nand_chip *chip, const u8 *buf,
 
        /* Write oob */
        if (oob_required) {
-               ret = nand_change_write_column_op(chip, mtd->writesize,
-                                                 chip->oob_poi, mtd->oobsize,
-                                                 false);
+               unsigned int offset_in_page = mtd->writesize;
+               const void *buf = chip->oob_poi;
+               unsigned int len = mtd->oobsize;
+
+               if (!raw) {
+                       struct mtd_oob_region oob_free;
+
+                       mtd_ooblayout_free(mtd, 0, &oob_free);
+                       offset_in_page += oob_free.offset;
+                       buf += oob_free.offset;
+                       len = oob_free.length;
+               }
+
+               ret = nand_change_write_column_op(chip, offset_in_page,
+                                                 buf, len, false);
                if (ret)
                        return ret;
        }