Commit 745df179 authored by Michał Kępień's avatar Michał Kępień Committed by Miquel Raynal
Browse files

mtd: always initialize 'stats' in struct mtd_oob_ops 



As the 'stats' field in struct mtd_oob_ops is used in conditional
expressions, ensure it is always zero-initialized in all such structures
to prevent random stack garbage from being interpreted as a pointer.

Strictly speaking, this problem currently only needs to be fixed for
struct mtd_oob_ops structures subsequently passed to mtd_read_oob().
However, this commit goes a step further and makes all instances of
struct mtd_oob_ops in the tree zero-initialized, in hope of preventing
future problems, e.g. if struct mtd_req_stats gets extended with write
statistics at some point.

Signed-off-by: default avatarMichał Kępień <kernel@kempniu.pl>
Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-3-kernel@kempniu.pl
parent 65394169

drivers/mtd/inftlcore.c

+3 −3
Original line number Diff line number Diff line
@@ -136,7 +136,7 @@ static void inftl_remove_dev(struct mtd_blktrans_dev *dev) 
int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,

		   size_t *retlen, uint8_t *buf)

{

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int res;



	ops.mode = MTD_OPS_PLACE_OOB;
@@ -156,7 +156,7 @@ int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len, 
int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,

		    size_t *retlen, uint8_t *buf)

{

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int res;



	ops.mode = MTD_OPS_PLACE_OOB;
@@ -176,7 +176,7 @@ int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len, 
static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len,

		       size_t *retlen, uint8_t *buf, uint8_t *oob)

{

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int res;



	ops.mode = MTD_OPS_PLACE_OOB;

drivers/mtd/mtdswap.c

+3 −3
Original line number Diff line number Diff line
@@ -323,7 +323,7 @@ static int mtdswap_read_markers(struct mtdswap_dev *d, struct swap_eb *eb) 
	struct mtdswap_oobdata *data, *data2;

	int ret;

	loff_t offset;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };



	offset = mtdswap_eb_offset(d, eb);
@@ -370,7 +370,7 @@ static int mtdswap_write_marker(struct mtdswap_dev *d, struct swap_eb *eb, 
	struct mtdswap_oobdata n;

	int ret;

	loff_t offset;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };



	ops.ooboffs = 0;

	ops.oobbuf = (uint8_t *)&n;
@@ -878,7 +878,7 @@ static unsigned int mtdswap_eblk_passes(struct mtdswap_dev *d, 
	loff_t base, pos;

	unsigned int *p1 = (unsigned int *)d->page_buf;

	unsigned char *p2 = (unsigned char *)d->oob_buf;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int ret;



	ops.mode = MTD_OPS_AUTO_OOB;

drivers/mtd/nand/onenand/onenand_base.c

+2 −2
Original line number Diff line number Diff line
@@ -2935,7 +2935,7 @@ static int do_otp_write(struct mtd_info *mtd, loff_t to, size_t len, 
	struct onenand_chip *this = mtd->priv;

	unsigned char *pbuf = buf;

	int ret;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };



	/* Force buffer page aligned */

	if (len < mtd->writesize) {
@@ -2977,7 +2977,7 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len, 
		size_t *retlen, u_char *buf)

{

	struct onenand_chip *this = mtd->priv;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int ret;



	if (FLEXONENAND(this)) {

drivers/mtd/nand/onenand/onenand_bbt.c

+1 −1
Original line number Diff line number Diff line
@@ -61,7 +61,7 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf, struct nand_bbt_descr 
	int startblock;

	loff_t from;

	size_t readlen;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int rgn;



	printk(KERN_INFO "Scanning device for bad blocks\n");

drivers/mtd/nand/raw/nand_bbt.c

+4 −4
Original line number Diff line number Diff line
@@ -313,7 +313,7 @@ static int scan_read_oob(struct nand_chip *this, uint8_t *buf, loff_t offs, 
			 size_t len)

{

	struct mtd_info *mtd = nand_to_mtd(this);

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int res, ret = 0;



	ops.mode = MTD_OPS_PLACE_OOB;
@@ -354,7 +354,7 @@ static int scan_write_bbt(struct nand_chip *this, loff_t offs, size_t len, 
			  uint8_t *buf, uint8_t *oob)

{

	struct mtd_info *mtd = nand_to_mtd(this);

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };



	ops.mode = MTD_OPS_PLACE_OOB;

	ops.ooboffs = 0;
@@ -416,7 +416,7 @@ static int scan_block_fast(struct nand_chip *this, struct nand_bbt_descr *bd, 
{

	struct mtd_info *mtd = nand_to_mtd(this);



	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };

	int ret, page_offset;



	ops.ooblen = mtd->oobsize;
@@ -756,7 +756,7 @@ static int write_bbt(struct nand_chip *this, uint8_t *buf, 
	uint8_t rcode = td->reserved_block_code;

	size_t retlen, len = 0;

	loff_t to;

	struct mtd_oob_ops ops;

	struct mtd_oob_ops ops = { };



	ops.ooblen = mtd->oobsize;

	ops.ooboffs = 0;