mtd: always initialize 'stats' in struct mtd_oob_ops

As the 'stats' field in struct mtd_oob_ops is used in conditional
expressions, ensure it is always zero-initialized in all such structures
to prevent random stack garbage from being interpreted as a pointer.

Strictly speaking, this problem currently only needs to be fixed for
struct mtd_oob_ops structures subsequently passed to mtd_read_oob().
However, this commit goes a step further and makes all instances of
struct mtd_oob_ops in the tree zero-initialized, in hope of preventing
future problems, e.g. if struct mtd_req_stats gets extended with write
statistics at some point.

Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-3-kernel@kempniu.pl
This commit is contained in:
Michał Kępień 2022-06-29 14:57:35 +02:00 committed by Miquel Raynal
parent 65394169bd
commit 745df17906
13 changed files with 29 additions and 29 deletions

View File

@ -136,7 +136,7 @@ static void inftl_remove_dev(struct mtd_blktrans_dev *dev)
int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len, int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
size_t *retlen, uint8_t *buf) size_t *retlen, uint8_t *buf)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res; int res;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
@ -156,7 +156,7 @@ int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len, int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
size_t *retlen, uint8_t *buf) size_t *retlen, uint8_t *buf)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res; int res;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
@ -176,7 +176,7 @@ int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len, static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
size_t *retlen, uint8_t *buf, uint8_t *oob) size_t *retlen, uint8_t *buf, uint8_t *oob)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res; int res;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;

View File

@ -323,7 +323,7 @@ static int mtdswap_read_markers(struct mtdswap_dev *d, struct swap_eb *eb)
struct mtdswap_oobdata *data, *data2; struct mtdswap_oobdata *data, *data2;
int ret; int ret;
loff_t offset; loff_t offset;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
offset = mtdswap_eb_offset(d, eb); offset = mtdswap_eb_offset(d, eb);
@ -370,7 +370,7 @@ static int mtdswap_write_marker(struct mtdswap_dev *d, struct swap_eb *eb,
struct mtdswap_oobdata n; struct mtdswap_oobdata n;
int ret; int ret;
loff_t offset; loff_t offset;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
ops.ooboffs = 0; ops.ooboffs = 0;
ops.oobbuf = (uint8_t *)&n; ops.oobbuf = (uint8_t *)&n;
@ -878,7 +878,7 @@ static unsigned int mtdswap_eblk_passes(struct mtdswap_dev *d,
loff_t base, pos; loff_t base, pos;
unsigned int *p1 = (unsigned int *)d->page_buf; unsigned int *p1 = (unsigned int *)d->page_buf;
unsigned char *p2 = (unsigned char *)d->oob_buf; unsigned char *p2 = (unsigned char *)d->oob_buf;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int ret; int ret;
ops.mode = MTD_OPS_AUTO_OOB; ops.mode = MTD_OPS_AUTO_OOB;

View File

@ -2935,7 +2935,7 @@ static int do_otp_write(struct mtd_info *mtd, loff_t to, size_t len,
struct onenand_chip *this = mtd->priv; struct onenand_chip *this = mtd->priv;
unsigned char *pbuf = buf; unsigned char *pbuf = buf;
int ret; int ret;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
/* Force buffer page aligned */ /* Force buffer page aligned */
if (len < mtd->writesize) { if (len < mtd->writesize) {
@ -2977,7 +2977,7 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
size_t *retlen, u_char *buf) size_t *retlen, u_char *buf)
{ {
struct onenand_chip *this = mtd->priv; struct onenand_chip *this = mtd->priv;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int ret; int ret;
if (FLEXONENAND(this)) { if (FLEXONENAND(this)) {

View File

@ -61,7 +61,7 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf, struct nand_bbt_descr
int startblock; int startblock;
loff_t from; loff_t from;
size_t readlen; size_t readlen;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int rgn; int rgn;
printk(KERN_INFO "Scanning device for bad blocks\n"); printk(KERN_INFO "Scanning device for bad blocks\n");

View File

@ -313,7 +313,7 @@ static int scan_read_oob(struct nand_chip *this, uint8_t *buf, loff_t offs,
size_t len) size_t len)
{ {
struct mtd_info *mtd = nand_to_mtd(this); struct mtd_info *mtd = nand_to_mtd(this);
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res, ret = 0; int res, ret = 0;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
@ -354,7 +354,7 @@ static int scan_write_bbt(struct nand_chip *this, loff_t offs, size_t len,
uint8_t *buf, uint8_t *oob) uint8_t *buf, uint8_t *oob)
{ {
struct mtd_info *mtd = nand_to_mtd(this); struct mtd_info *mtd = nand_to_mtd(this);
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
ops.ooboffs = 0; ops.ooboffs = 0;
@ -416,7 +416,7 @@ static int scan_block_fast(struct nand_chip *this, struct nand_bbt_descr *bd,
{ {
struct mtd_info *mtd = nand_to_mtd(this); struct mtd_info *mtd = nand_to_mtd(this);
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int ret, page_offset; int ret, page_offset;
ops.ooblen = mtd->oobsize; ops.ooblen = mtd->oobsize;
@ -756,7 +756,7 @@ static int write_bbt(struct nand_chip *this, uint8_t *buf,
uint8_t rcode = td->reserved_block_code; uint8_t rcode = td->reserved_block_code;
size_t retlen, len = 0; size_t retlen, len = 0;
loff_t to; loff_t to;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
ops.ooblen = mtd->oobsize; ops.ooblen = mtd->oobsize;
ops.ooboffs = 0; ops.ooboffs = 0;

View File

@ -99,7 +99,7 @@ static const struct mtd_ooblayout_ops oob_sm_small_ops = {
static int sm_block_markbad(struct nand_chip *chip, loff_t ofs) static int sm_block_markbad(struct nand_chip *chip, loff_t ofs)
{ {
struct mtd_info *mtd = nand_to_mtd(chip); struct mtd_info *mtd = nand_to_mtd(chip);
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
struct sm_oob oob; struct sm_oob oob;
int ret; int ret;

View File

@ -124,7 +124,7 @@ int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
size_t *retlen, uint8_t *buf) size_t *retlen, uint8_t *buf)
{ {
loff_t mask = mtd->writesize - 1; loff_t mask = mtd->writesize - 1;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res; int res;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
@ -145,7 +145,7 @@ int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
size_t *retlen, uint8_t *buf) size_t *retlen, uint8_t *buf)
{ {
loff_t mask = mtd->writesize - 1; loff_t mask = mtd->writesize - 1;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res; int res;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
@ -168,7 +168,7 @@ static int nftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
size_t *retlen, uint8_t *buf, uint8_t *oob) size_t *retlen, uint8_t *buf, uint8_t *oob)
{ {
loff_t mask = mtd->writesize - 1; loff_t mask = mtd->writesize - 1;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int res; int res;
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;

View File

@ -239,7 +239,7 @@ static int sm_read_sector(struct sm_ftl *ftl,
uint8_t *buffer, struct sm_oob *oob) uint8_t *buffer, struct sm_oob *oob)
{ {
struct mtd_info *mtd = ftl->trans->mtd; struct mtd_info *mtd = ftl->trans->mtd;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
struct sm_oob tmp_oob; struct sm_oob tmp_oob;
int ret = -EIO; int ret = -EIO;
int try = 0; int try = 0;
@ -323,7 +323,7 @@ static int sm_write_sector(struct sm_ftl *ftl,
int zone, int block, int boffset, int zone, int block, int boffset,
uint8_t *buffer, struct sm_oob *oob) uint8_t *buffer, struct sm_oob *oob)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
struct mtd_info *mtd = ftl->trans->mtd; struct mtd_info *mtd = ftl->trans->mtd;
int ret; int ret;

View File

@ -163,7 +163,7 @@ static int read_physical_sector(struct mtd_info *mtd, uint8_t *sect_buf,
/* Read redundancy area (wrapper to MTD_READ_OOB */ /* Read redundancy area (wrapper to MTD_READ_OOB */
static int read_raw_oob(struct mtd_info *mtd, loff_t offs, uint8_t *buf) static int read_raw_oob(struct mtd_info *mtd, loff_t offs, uint8_t *buf)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int ret; int ret;
ops.mode = MTD_OPS_RAW; ops.mode = MTD_OPS_RAW;

View File

@ -99,7 +99,7 @@ static int write_page(int log)
static int rewrite_page(int log) static int rewrite_page(int log)
{ {
int err = 0; int err = 0;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
if (log) if (log)
pr_info("rewrite page\n"); pr_info("rewrite page\n");

View File

@ -56,7 +56,7 @@ static void do_vary_offset(void)
static int write_eraseblock(int ebnum) static int write_eraseblock(int ebnum)
{ {
int i; int i;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int err = 0; int err = 0;
loff_t addr = (loff_t)ebnum * mtd->erasesize; loff_t addr = (loff_t)ebnum * mtd->erasesize;
@ -165,7 +165,7 @@ static size_t memffshow(loff_t addr, loff_t offset, const void *cs,
static int verify_eraseblock(int ebnum) static int verify_eraseblock(int ebnum)
{ {
int i; int i;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int err = 0; int err = 0;
loff_t addr = (loff_t)ebnum * mtd->erasesize; loff_t addr = (loff_t)ebnum * mtd->erasesize;
size_t bitflips; size_t bitflips;
@ -260,7 +260,7 @@ static int verify_eraseblock(int ebnum)
static int verify_eraseblock_in_one_go(int ebnum) static int verify_eraseblock_in_one_go(int ebnum)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int err = 0; int err = 0;
loff_t addr = (loff_t)ebnum * mtd->erasesize; loff_t addr = (loff_t)ebnum * mtd->erasesize;
size_t len = mtd->oobavail * pgcnt; size_t len = mtd->oobavail * pgcnt;
@ -338,7 +338,7 @@ static int __init mtd_oobtest_init(void)
int err = 0; int err = 0;
unsigned int i; unsigned int i;
uint64_t tmp; uint64_t tmp;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
loff_t addr = 0, addr0; loff_t addr = 0, addr0;
printk(KERN_INFO "\n"); printk(KERN_INFO "\n");

View File

@ -47,7 +47,7 @@ static int read_eraseblock_by_page(int ebnum)
err = ret; err = ret;
} }
if (mtd->oobsize) { if (mtd->oobsize) {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
ops.mode = MTD_OPS_PLACE_OOB; ops.mode = MTD_OPS_PLACE_OOB;
ops.len = 0; ops.len = 0;

View File

@ -1035,7 +1035,7 @@ int jffs2_check_oob_empty(struct jffs2_sb_info *c,
{ {
int i, ret; int i, ret;
int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE); int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
ops.mode = MTD_OPS_AUTO_OOB; ops.mode = MTD_OPS_AUTO_OOB;
ops.ooblen = NR_OOB_SCAN_PAGES * c->oobavail; ops.ooblen = NR_OOB_SCAN_PAGES * c->oobavail;
@ -1076,7 +1076,7 @@ int jffs2_check_oob_empty(struct jffs2_sb_info *c,
int jffs2_check_nand_cleanmarker(struct jffs2_sb_info *c, int jffs2_check_nand_cleanmarker(struct jffs2_sb_info *c,
struct jffs2_eraseblock *jeb) struct jffs2_eraseblock *jeb)
{ {
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int ret, cmlen = min_t(int, c->oobavail, OOB_CM_SIZE); int ret, cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
ops.mode = MTD_OPS_AUTO_OOB; ops.mode = MTD_OPS_AUTO_OOB;
@ -1101,7 +1101,7 @@ int jffs2_write_nand_cleanmarker(struct jffs2_sb_info *c,
struct jffs2_eraseblock *jeb) struct jffs2_eraseblock *jeb)
{ {
int ret; int ret;
struct mtd_oob_ops ops; struct mtd_oob_ops ops = { };
int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE); int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
ops.mode = MTD_OPS_AUTO_OOB; ops.mode = MTD_OPS_AUTO_OOB;