On Thu, Sep 16, 2010 at 02:41:23PM +0800, Roy Zang wrote:
[...]

-static int __devinit fsl_elbc_chip_probe(struct fsl_elbc_ctrl *ctrl,
-                                      struct device_node *node)
+/*
+ * Currently only one elbc probe is supported.
+ */
+static int __devinit fsl_elbc_nand_probe(struct platform_device *dev)
 {
-     struct fsl_lbc_regs __iomem *lbc = ctrl->regs;
+     struct fsl_lbc_regs __iomem *lbc;
      struct fsl_elbc_mtd *priv;
      struct resource res;
+     struct fsl_elbc_fcm_ctrl *elbc_fcm_ctrl = NULL;

[...]

-     ctrl->chips[bank] = priv;
+     if (fsl_lbc_ctrl_dev->nand == NULL) {
+             elbc_fcm_ctrl = kzalloc(sizeof(*elbc_fcm_ctrl), GFP_KERNEL);
+             if (!elbc_fcm_ctrl) {

[...]

+                     goto err;
+             }
+             fsl_lbc_ctrl_dev->nand = elbc_fcm_ctrl;
+     }
+
+     elbc_fcm_ctrl->chips[bank] = priv;

Again, this will oops on the second probe. And you still don't
lock fsl_lbc_ctrl_dev->nand during check-then-assignment, so
with parallel probing there will be a race. :-(

We do have boards with several NAND chips (e.g.
arch/powerpc/boot/dts/mpc8610_hpcd.dts), so these issues
are all legitimate.

Thanks,

-- 
Anton Vorontsov
email: cbouatmailru@gmail.com
irc://irc.freenode.net/bd2