projects / openwrt / openwrt.git / blob
? search:


1484624e4e51940acb08e749bf88cfda686a6128
[openwrt/openwrt.git] /
1 From e97709c9d18903f5acd5fbe2985dd054da0432b1 Mon Sep 17 00:00:00 2001
2 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
3 Date: Wed, 29 Jun 2022 14:57:35 +0200
4 Subject: [PATCH 2/4] mtd: always initialize 'stats' in struct mtd_oob_ops
5 MIME-Version: 1.0
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
8
9 As the 'stats' field in struct mtd_oob_ops is used in conditional
10 expressions, ensure it is always zero-initialized in all such structures
11 to prevent random stack garbage from being interpreted as a pointer.
12
13 Strictly speaking, this problem currently only needs to be fixed for
14 struct mtd_oob_ops structures subsequently passed to mtd_read_oob().
15 However, this commit goes a step further and makes all instances of
16 struct mtd_oob_ops in the tree zero-initialized, in hope of preventing
17 future problems, e.g. if struct mtd_req_stats gets extended with write
18 statistics at some point.
19
20 Signed-off-by: Michał Kępień <kernel@kempniu.pl>
21 Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
22 Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-3-kernel@kempniu.pl
23 ---
24 drivers/mtd/inftlcore.c | 6 +++---
25 drivers/mtd/mtdswap.c | 6 +++---
26 drivers/mtd/nand/onenand/onenand_base.c | 4 ++--
27 drivers/mtd/nand/onenand/onenand_bbt.c | 2 +-
28 drivers/mtd/nand/raw/nand_bbt.c | 8 ++++----
29 drivers/mtd/nand/raw/sm_common.c | 2 +-
30 drivers/mtd/nftlcore.c | 6 +++---
31 drivers/mtd/sm_ftl.c | 4 ++--
32 drivers/mtd/ssfdc.c | 2 +-
33 drivers/mtd/tests/nandbiterrs.c | 2 +-
34 drivers/mtd/tests/oobtest.c | 8 ++++----
35 drivers/mtd/tests/readtest.c | 2 +-
36 fs/jffs2/wbuf.c | 6 +++---
37 13 files changed, 29 insertions(+), 29 deletions(-)
38
39 --- a/drivers/mtd/inftlcore.c
40 +++ b/drivers/mtd/inftlcore.c
41 @@ -136,7 +136,7 @@ static void inftl_remove_dev(struct mtd_
42 int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
43 size_t *retlen, uint8_t *buf)
44 {
45 - struct mtd_oob_ops ops;
46 + struct mtd_oob_ops ops = { };
47 int res;
48
49 ops.mode = MTD_OPS_PLACE_OOB;
50 @@ -156,7 +156,7 @@ int inftl_read_oob(struct mtd_info *mtd,
51 int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
52 size_t *retlen, uint8_t *buf)
53 {
54 - struct mtd_oob_ops ops;
55 + struct mtd_oob_ops ops = { };
56 int res;
57
58 ops.mode = MTD_OPS_PLACE_OOB;
59 @@ -176,7 +176,7 @@ int inftl_write_oob(struct mtd_info *mtd
60 static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
61 size_t *retlen, uint8_t *buf, uint8_t *oob)
62 {
63 - struct mtd_oob_ops ops;
64 + struct mtd_oob_ops ops = { };
65 int res;
66
67 ops.mode = MTD_OPS_PLACE_OOB;
68 --- a/drivers/mtd/mtdswap.c
69 +++ b/drivers/mtd/mtdswap.c
70 @@ -323,7 +323,7 @@ static int mtdswap_read_markers(struct m
71 struct mtdswap_oobdata *data, *data2;
72 int ret;
73 loff_t offset;
74 - struct mtd_oob_ops ops;
75 + struct mtd_oob_ops ops = { };
76
77 offset = mtdswap_eb_offset(d, eb);
78
79 @@ -370,7 +370,7 @@ static int mtdswap_write_marker(struct m
80 struct mtdswap_oobdata n;
81 int ret;
82 loff_t offset;
83 - struct mtd_oob_ops ops;
84 + struct mtd_oob_ops ops = { };
85
86 ops.ooboffs = 0;
87 ops.oobbuf = (uint8_t *)&n;
88 @@ -879,7 +879,7 @@ static unsigned int mtdswap_eblk_passes(
89 loff_t base, pos;
90 unsigned int *p1 = (unsigned int *)d->page_buf;
91 unsigned char *p2 = (unsigned char *)d->oob_buf;
92 - struct mtd_oob_ops ops;
93 + struct mtd_oob_ops ops = { };
94 int ret;
95
96 ops.mode = MTD_OPS_AUTO_OOB;
97 --- a/drivers/mtd/nand/onenand/onenand_base.c
98 +++ b/drivers/mtd/nand/onenand/onenand_base.c
99 @@ -2935,7 +2935,7 @@ static int do_otp_write(struct mtd_info
100 struct onenand_chip *this = mtd->priv;
101 unsigned char *pbuf = buf;
102 int ret;
103 - struct mtd_oob_ops ops;
104 + struct mtd_oob_ops ops = { };
105
106 /* Force buffer page aligned */
107 if (len < mtd->writesize) {
108 @@ -2977,7 +2977,7 @@ static int do_otp_lock(struct mtd_info *
109 size_t *retlen, u_char *buf)
110 {
111 struct onenand_chip *this = mtd->priv;
112 - struct mtd_oob_ops ops;
113 + struct mtd_oob_ops ops = { };
114 int ret;
115
116 if (FLEXONENAND(this)) {
117 --- a/drivers/mtd/nand/onenand/onenand_bbt.c
118 +++ b/drivers/mtd/nand/onenand/onenand_bbt.c
119 @@ -61,7 +61,7 @@ static int create_bbt(struct mtd_info *m
120 int startblock;
121 loff_t from;
122 size_t readlen, ooblen;
123 - struct mtd_oob_ops ops;
124 + struct mtd_oob_ops ops = { };
125 int rgn;
126
127 printk(KERN_INFO "Scanning device for bad blocks\n");
128 --- a/drivers/mtd/nand/raw/nand_bbt.c
129 +++ b/drivers/mtd/nand/raw/nand_bbt.c
130 @@ -313,7 +313,7 @@ static int scan_read_oob(struct nand_chi
131 size_t len)
132 {
133 struct mtd_info *mtd = nand_to_mtd(this);
134 - struct mtd_oob_ops ops;
135 + struct mtd_oob_ops ops = { };
136 int res, ret = 0;
137
138 ops.mode = MTD_OPS_PLACE_OOB;
139 @@ -354,7 +354,7 @@ static int scan_write_bbt(struct nand_ch
140 uint8_t *buf, uint8_t *oob)
141 {
142 struct mtd_info *mtd = nand_to_mtd(this);
143 - struct mtd_oob_ops ops;
144 + struct mtd_oob_ops ops = { };
145
146 ops.mode = MTD_OPS_PLACE_OOB;
147 ops.ooboffs = 0;
148 @@ -416,7 +416,7 @@ static int scan_block_fast(struct nand_c
149 {
150 struct mtd_info *mtd = nand_to_mtd(this);
151
152 - struct mtd_oob_ops ops;
153 + struct mtd_oob_ops ops = { };
154 int ret, page_offset;
155
156 ops.ooblen = mtd->oobsize;
157 @@ -756,7 +756,7 @@ static int write_bbt(struct nand_chip *t
158 uint8_t rcode = td->reserved_block_code;
159 size_t retlen, len = 0;
160 loff_t to;
161 - struct mtd_oob_ops ops;
162 + struct mtd_oob_ops ops = { };
163
164 ops.ooblen = mtd->oobsize;
165 ops.ooboffs = 0;
166 --- a/drivers/mtd/nand/raw/sm_common.c
167 +++ b/drivers/mtd/nand/raw/sm_common.c
168 @@ -99,7 +99,7 @@ static const struct mtd_ooblayout_ops oo
169 static int sm_block_markbad(struct nand_chip *chip, loff_t ofs)
170 {
171 struct mtd_info *mtd = nand_to_mtd(chip);
172 - struct mtd_oob_ops ops;
173 + struct mtd_oob_ops ops = { };
174 struct sm_oob oob;
175 int ret;
176
177 --- a/drivers/mtd/nftlcore.c
178 +++ b/drivers/mtd/nftlcore.c
179 @@ -124,7 +124,7 @@ int nftl_read_oob(struct mtd_info *mtd,
180 size_t *retlen, uint8_t *buf)
181 {
182 loff_t mask = mtd->writesize - 1;
183 - struct mtd_oob_ops ops;
184 + struct mtd_oob_ops ops = { };
185 int res;
186
187 ops.mode = MTD_OPS_PLACE_OOB;
188 @@ -145,7 +145,7 @@ int nftl_write_oob(struct mtd_info *mtd,
189 size_t *retlen, uint8_t *buf)
190 {
191 loff_t mask = mtd->writesize - 1;
192 - struct mtd_oob_ops ops;
193 + struct mtd_oob_ops ops = { };
194 int res;
195
196 ops.mode = MTD_OPS_PLACE_OOB;
197 @@ -168,7 +168,7 @@ static int nftl_write(struct mtd_info *m
198 size_t *retlen, uint8_t *buf, uint8_t *oob)
199 {
200 loff_t mask = mtd->writesize - 1;
201 - struct mtd_oob_ops ops;
202 + struct mtd_oob_ops ops = { };
203 int res;
204
205 ops.mode = MTD_OPS_PLACE_OOB;
206 --- a/drivers/mtd/sm_ftl.c
207 +++ b/drivers/mtd/sm_ftl.c
208 @@ -239,7 +239,7 @@ static int sm_read_sector(struct sm_ftl
209 uint8_t *buffer, struct sm_oob *oob)
210 {
211 struct mtd_info *mtd = ftl->trans->mtd;
212 - struct mtd_oob_ops ops;
213 + struct mtd_oob_ops ops = { };
214 struct sm_oob tmp_oob;
215 int ret = -EIO;
216 int try = 0;
217 @@ -323,7 +323,7 @@ static int sm_write_sector(struct sm_ftl
218 int zone, int block, int boffset,
219 uint8_t *buffer, struct sm_oob *oob)
220 {
221 - struct mtd_oob_ops ops;
222 + struct mtd_oob_ops ops = { };
223 struct mtd_info *mtd = ftl->trans->mtd;
224 int ret;
225
226 --- a/drivers/mtd/ssfdc.c
227 +++ b/drivers/mtd/ssfdc.c
228 @@ -163,7 +163,7 @@ static int read_physical_sector(struct m
229 /* Read redundancy area (wrapper to MTD_READ_OOB */
230 static int read_raw_oob(struct mtd_info *mtd, loff_t offs, uint8_t *buf)
231 {
232 - struct mtd_oob_ops ops;
233 + struct mtd_oob_ops ops = { };
234 int ret;
235
236 ops.mode = MTD_OPS_RAW;
237 --- a/drivers/mtd/tests/nandbiterrs.c
238 +++ b/drivers/mtd/tests/nandbiterrs.c
239 @@ -99,7 +99,7 @@ static int write_page(int log)
240 static int rewrite_page(int log)
241 {
242 int err = 0;
243 - struct mtd_oob_ops ops;
244 + struct mtd_oob_ops ops = { };
245
246 if (log)
247 pr_info("rewrite page\n");
248 --- a/drivers/mtd/tests/oobtest.c
249 +++ b/drivers/mtd/tests/oobtest.c
250 @@ -56,7 +56,7 @@ static void do_vary_offset(void)
251 static int write_eraseblock(int ebnum)
252 {
253 int i;
254 - struct mtd_oob_ops ops;
255 + struct mtd_oob_ops ops = { };
256 int err = 0;
257 loff_t addr = (loff_t)ebnum * mtd->erasesize;
258
259 @@ -165,7 +165,7 @@ static size_t memffshow(loff_t addr, lof
260 static int verify_eraseblock(int ebnum)
261 {
262 int i;
263 - struct mtd_oob_ops ops;
264 + struct mtd_oob_ops ops = { };
265 int err = 0;
266 loff_t addr = (loff_t)ebnum * mtd->erasesize;
267 size_t bitflips;
268 @@ -260,7 +260,7 @@ static int verify_eraseblock(int ebnum)
269
270 static int verify_eraseblock_in_one_go(int ebnum)
271 {
272 - struct mtd_oob_ops ops;
273 + struct mtd_oob_ops ops = { };
274 int err = 0;
275 loff_t addr = (loff_t)ebnum * mtd->erasesize;
276 size_t len = mtd->oobavail * pgcnt;
277 @@ -338,7 +338,7 @@ static int __init mtd_oobtest_init(void)
278 int err = 0;
279 unsigned int i;
280 uint64_t tmp;
281 - struct mtd_oob_ops ops;
282 + struct mtd_oob_ops ops = { };
283 loff_t addr = 0, addr0;
284
285 printk(KERN_INFO "\n");
286 --- a/drivers/mtd/tests/readtest.c
287 +++ b/drivers/mtd/tests/readtest.c
288 @@ -47,7 +47,7 @@ static int read_eraseblock_by_page(int e
289 err = ret;
290 }
291 if (mtd->oobsize) {
292 - struct mtd_oob_ops ops;
293 + struct mtd_oob_ops ops = { };
294
295 ops.mode = MTD_OPS_PLACE_OOB;
296 ops.len = 0;
297 --- a/fs/jffs2/wbuf.c
298 +++ b/fs/jffs2/wbuf.c
299 @@ -1035,7 +1035,7 @@ int jffs2_check_oob_empty(struct jffs2_s
300 {
301 int i, ret;
302 int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
303 - struct mtd_oob_ops ops;
304 + struct mtd_oob_ops ops = { };
305
306 ops.mode = MTD_OPS_AUTO_OOB;
307 ops.ooblen = NR_OOB_SCAN_PAGES * c->oobavail;
308 @@ -1076,7 +1076,7 @@ int jffs2_check_oob_empty(struct jffs2_s
309 int jffs2_check_nand_cleanmarker(struct jffs2_sb_info *c,
310 struct jffs2_eraseblock *jeb)
311 {
312 - struct mtd_oob_ops ops;
313 + struct mtd_oob_ops ops = { };
314 int ret, cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
315
316 ops.mode = MTD_OPS_AUTO_OOB;
317 @@ -1101,7 +1101,7 @@ int jffs2_write_nand_cleanmarker(struct
318 struct jffs2_eraseblock *jeb)
319 {
320 int ret;
321 - struct mtd_oob_ops ops;
322 + struct mtd_oob_ops ops = { };
323 int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
324
325 ops.mode = MTD_OPS_AUTO_OOB;
OpenWrt Source Repository