mtd: always initialize 'stats' in struct mtd_oob_ops

As the 'stats' field in struct mtd_oob_ops is used in conditional
expressions, ensure it is always zero-initialized in all such structures
to prevent random stack garbage from being interpreted as a pointer.

Strictly speaking, this problem currently only needs to be fixed for
struct mtd_oob_ops structures subsequently passed to mtd_read_oob().
However, this commit goes a step further and makes all instances of
struct mtd_oob_ops in the tree zero-initialized, in hope of preventing
future problems, e.g. if struct mtd_req_stats gets extended with write
statistics at some point.

Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-3-kernel@kempniu.pl

diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
index 6b48397c750c2246b7e4b1efd19f60a09245b8a3..58ca1c21ebe671b724620d689a025c81c828637d 100644 (file)
--- a/drivers/mtd/inftlcore.c
+++ b/drivers/mtd/inftlcore.c
@@ -136,7 +136,7 @@ static void inftl_remove_dev(struct mtd_blktrans_dev *dev)
 int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                   size_t *retlen, uint8_t *buf)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res;
 
        ops.mode = MTD_OPS_PLACE_OOB;
@@ -156,7 +156,7 @@ int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
 int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                    size_t *retlen, uint8_t *buf)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res;
 
        ops.mode = MTD_OPS_PLACE_OOB;
@@ -176,7 +176,7 @@ int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
 static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
                       size_t *retlen, uint8_t *buf, uint8_t *oob)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res;
 
        ops.mode = MTD_OPS_PLACE_OOB;

diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c
index dc7f1532a37f7860146841003913b4b7e19323a2..680366616da240039ecfb4cc59c83fcc4b1bf615 100644 (file)
--- a/drivers/mtd/mtdswap.c
+++ b/drivers/mtd/mtdswap.c
@@ -323,7 +323,7 @@ static int mtdswap_read_markers(struct mtdswap_dev *d, struct swap_eb *eb)
        struct mtdswap_oobdata *data, *data2;
        int ret;
        loff_t offset;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        offset = mtdswap_eb_offset(d, eb);
 
@@ -370,7 +370,7 @@ static int mtdswap_write_marker(struct mtdswap_dev *d, struct swap_eb *eb,
        struct mtdswap_oobdata n;
        int ret;
        loff_t offset;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        ops.ooboffs = 0;
        ops.oobbuf = (uint8_t *)&n;
@@ -878,7 +878,7 @@ static unsigned int mtdswap_eblk_passes(struct mtdswap_dev *d,
        loff_t base, pos;
        unsigned int *p1 = (unsigned int *)d->page_buf;
        unsigned char *p2 = (unsigned char *)d->oob_buf;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int ret;
 
        ops.mode = MTD_OPS_AUTO_OOB;

diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c
index 958bac54b19078554a06c08019ddcd7abe02c41a..5810104420a2b5786669de030cd53df0e2644014 100644 (file)
--- a/drivers/mtd/nand/onenand/onenand_base.c
+++ b/drivers/mtd/nand/onenand/onenand_base.c
@@ -2935,7 +2935,7 @@ static int do_otp_write(struct mtd_info *mtd, loff_t to, size_t len,
        struct onenand_chip *this = mtd->priv;
        unsigned char *pbuf = buf;
        int ret;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        /* Force buffer page aligned */
        if (len < mtd->writesize) {
@@ -2977,7 +2977,7 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
                size_t *retlen, u_char *buf)
 {
        struct onenand_chip *this = mtd->priv;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int ret;
 
        if (FLEXONENAND(this)) {

diff --git a/drivers/mtd/nand/onenand/onenand_bbt.c b/drivers/mtd/nand/onenand/onenand_bbt.c
index b17315f8e1d47a388b0e7ae1cceea35d951ea8a1..d7fe35bc45cba50649650f2f166a4d20a07eb189 100644 (file)
--- a/drivers/mtd/nand/onenand/onenand_bbt.c
+++ b/drivers/mtd/nand/onenand/onenand_bbt.c
@@ -61,7 +61,7 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf, struct nand_bbt_descr
        int startblock;
        loff_t from;
        size_t readlen;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int rgn;
 
        printk(KERN_INFO "Scanning device for bad blocks\n");

diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c
index a3723da2e0a019951ccb6624113a6c8b0199df32..e4664fa6fd9ef2b199f07a27c05f5299b6c5a2ec 100644 (file)
--- a/drivers/mtd/nand/raw/nand_bbt.c
+++ b/drivers/mtd/nand/raw/nand_bbt.c
@@ -313,7 +313,7 @@ static int scan_read_oob(struct nand_chip *this, uint8_t *buf, loff_t offs,
                         size_t len)
 {
        struct mtd_info *mtd = nand_to_mtd(this);
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res, ret = 0;
 
        ops.mode = MTD_OPS_PLACE_OOB;
@@ -354,7 +354,7 @@ static int scan_write_bbt(struct nand_chip *this, loff_t offs, size_t len,
                          uint8_t *buf, uint8_t *oob)
 {
        struct mtd_info *mtd = nand_to_mtd(this);
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        ops.mode = MTD_OPS_PLACE_OOB;
        ops.ooboffs = 0;
@@ -416,7 +416,7 @@ static int scan_block_fast(struct nand_chip *this, struct nand_bbt_descr *bd,
 {
        struct mtd_info *mtd = nand_to_mtd(this);
 
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int ret, page_offset;
 
        ops.ooblen = mtd->oobsize;
@@ -756,7 +756,7 @@ static int write_bbt(struct nand_chip *this, uint8_t *buf,
        uint8_t rcode = td->reserved_block_code;
        size_t retlen, len = 0;
        loff_t to;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        ops.ooblen = mtd->oobsize;
        ops.ooboffs = 0;

diff --git a/drivers/mtd/nand/raw/sm_common.c b/drivers/mtd/nand/raw/sm_common.c
index b2b42dd1a2de629bb52465b64bb352d7a4107a66..24f52a30fb1304c9dbe4625a544b541a2db1eaae 100644 (file)
--- a/drivers/mtd/nand/raw/sm_common.c
+++ b/drivers/mtd/nand/raw/sm_common.c
@@ -99,7 +99,7 @@ static const struct mtd_ooblayout_ops oob_sm_small_ops = {
 static int sm_block_markbad(struct nand_chip *chip, loff_t ofs)
 {
        struct mtd_info *mtd = nand_to_mtd(chip);
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        struct sm_oob oob;
        int ret;
 

diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index 913db0dd6a8debde938a10e7b11af3421fa8ccef..64d319e959b239bbab101cf71918080cd733f13f 100644 (file)
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -124,7 +124,7 @@ int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                  size_t *retlen, uint8_t *buf)
 {
        loff_t mask = mtd->writesize - 1;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res;
 
        ops.mode = MTD_OPS_PLACE_OOB;
@@ -145,7 +145,7 @@ int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                   size_t *retlen, uint8_t *buf)
 {
        loff_t mask = mtd->writesize - 1;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res;
 
        ops.mode = MTD_OPS_PLACE_OOB;
@@ -168,7 +168,7 @@ static int nftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
                      size_t *retlen, uint8_t *buf, uint8_t *oob)
 {
        loff_t mask = mtd->writesize - 1;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int res;
 
        ops.mode = MTD_OPS_PLACE_OOB;

diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 7f955fade83836a352df03c1c78449a7cc9dc68f..4cfec3b7b4461d585381a5037ac8c81e807bba10 100644 (file)
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -239,7 +239,7 @@ static int sm_read_sector(struct sm_ftl *ftl,
                          uint8_t *buffer, struct sm_oob *oob)
 {
        struct mtd_info *mtd = ftl->trans->mtd;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        struct sm_oob tmp_oob;
        int ret = -EIO;
        int try = 0;
@@ -323,7 +323,7 @@ static int sm_write_sector(struct sm_ftl *ftl,
                           int zone, int block, int boffset,
                           uint8_t *buffer, struct sm_oob *oob)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        struct mtd_info *mtd = ftl->trans->mtd;
        int ret;
 

diff --git a/drivers/mtd/ssfdc.c b/drivers/mtd/ssfdc.c
index 1d05c121904ce157fef314f0c3daea3b9597b5c5..04da685c36be497dff88e0c6029adfcaf1e7c728 100644 (file)
--- a/drivers/mtd/ssfdc.c
+++ b/drivers/mtd/ssfdc.c
@@ -163,7 +163,7 @@ static int read_physical_sector(struct mtd_info *mtd, uint8_t *sect_buf,
 /* Read redundancy area (wrapper to MTD_READ_OOB */
 static int read_raw_oob(struct mtd_info *mtd, loff_t offs, uint8_t *buf)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int ret;
 
        ops.mode = MTD_OPS_RAW;

diff --git a/drivers/mtd/tests/nandbiterrs.c b/drivers/mtd/tests/nandbiterrs.c
index 08084c018a59a8863de361e1f9631a8c8b36df0a..98d7508f95b18d23b576eeb6ed1d17896de9eb60 100644 (file)
--- a/drivers/mtd/tests/nandbiterrs.c
+++ b/drivers/mtd/tests/nandbiterrs.c
@@ -99,7 +99,7 @@ static int write_page(int log)
 static int rewrite_page(int log)
 {
        int err = 0;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        if (log)
                pr_info("rewrite page\n");

diff --git a/drivers/mtd/tests/oobtest.c b/drivers/mtd/tests/oobtest.c
index 532997e10e299ad3449e06dbea37642915877bfa..13fed398937e4034082cd0742b935b3d098714f5 100644 (file)
--- a/drivers/mtd/tests/oobtest.c
+++ b/drivers/mtd/tests/oobtest.c
@@ -56,7 +56,7 @@ static void do_vary_offset(void)
 static int write_eraseblock(int ebnum)
 {
        int i;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int err = 0;
        loff_t addr = (loff_t)ebnum * mtd->erasesize;
 
@@ -165,7 +165,7 @@ static size_t memffshow(loff_t addr, loff_t offset, const void *cs,
 static int verify_eraseblock(int ebnum)
 {
        int i;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int err = 0;
        loff_t addr = (loff_t)ebnum * mtd->erasesize;
        size_t bitflips;
@@ -260,7 +260,7 @@ static int verify_eraseblock(int ebnum)
 
 static int verify_eraseblock_in_one_go(int ebnum)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int err = 0;
        loff_t addr = (loff_t)ebnum * mtd->erasesize;
        size_t len = mtd->oobavail * pgcnt;
@@ -338,7 +338,7 @@ static int __init mtd_oobtest_init(void)
        int err = 0;
        unsigned int i;
        uint64_t tmp;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        loff_t addr = 0, addr0;
 
        printk(KERN_INFO "\n");

diff --git a/drivers/mtd/tests/readtest.c b/drivers/mtd/tests/readtest.c
index e70d588083a32057d808a91ce22dce7e1f06369b..99670ef91f2b891d99e3797cb0bd2bea2fcf21b5 100644 (file)
--- a/drivers/mtd/tests/readtest.c
+++ b/drivers/mtd/tests/readtest.c
@@ -47,7 +47,7 @@ static int read_eraseblock_by_page(int ebnum)
                                err = ret;
                }
                if (mtd->oobsize) {
-                       struct mtd_oob_ops ops;
+                       struct mtd_oob_ops ops = { };
 
                        ops.mode      = MTD_OPS_PLACE_OOB;
                        ops.len       = 0;

diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index c6821a5094818a48030697b95178241304905d28..4061e0ba70103c3c2f78c112a0336718bdd6e03d 100644 (file)
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -1035,7 +1035,7 @@ int jffs2_check_oob_empty(struct jffs2_sb_info *c,
 {
        int i, ret;
        int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
 
        ops.mode = MTD_OPS_AUTO_OOB;
        ops.ooblen = NR_OOB_SCAN_PAGES * c->oobavail;
@@ -1076,7 +1076,7 @@ int jffs2_check_oob_empty(struct jffs2_sb_info *c,
 int jffs2_check_nand_cleanmarker(struct jffs2_sb_info *c,
                                 struct jffs2_eraseblock *jeb)
 {
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int ret, cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
 
        ops.mode = MTD_OPS_AUTO_OOB;
@@ -1101,7 +1101,7 @@ int jffs2_write_nand_cleanmarker(struct jffs2_sb_info *c,
                                 struct jffs2_eraseblock *jeb)
 {
        int ret;
-       struct mtd_oob_ops ops;
+       struct mtd_oob_ops ops = { };
        int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
 
        ops.mode = MTD_OPS_AUTO_OOB;