target/linux/generic/backport-5.15/423-v6.1-0002-mtd-always-initialize-stats-in-struct-mtd_oob_ops.patch

   1 From e97709c9d18903f5acd5fbe2985dd054da0432b1 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
   3 Date: Wed, 29 Jun 2022 14:57:35 +0200
   4 Subject: [PATCH 2/4] mtd: always initialize 'stats' in struct mtd_oob_ops
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 As the 'stats' field in struct mtd_oob_ops is used in conditional
  10 expressions, ensure it is always zero-initialized in all such structures
  11 to prevent random stack garbage from being interpreted as a pointer.
  12
  13 Strictly speaking, this problem currently only needs to be fixed for
  14 struct mtd_oob_ops structures subsequently passed to mtd_read_oob().
  15 However, this commit goes a step further and makes all instances of
  16 struct mtd_oob_ops in the tree zero-initialized, in hope of preventing
  17 future problems, e.g. if struct mtd_req_stats gets extended with write
  18 statistics at some point.
  19
  20 Signed-off-by: Michał Kępień <kernel@kempniu.pl>
  21 Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
  22 Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-3-kernel@kempniu.pl
  23 ---
  24  drivers/mtd/inftlcore.c                 | 6 +++---
  25  drivers/mtd/mtdswap.c                   | 6 +++---
  26  drivers/mtd/nand/onenand/onenand_base.c | 4 ++--
  27  drivers/mtd/nand/onenand/onenand_bbt.c  | 2 +-
  28  drivers/mtd/nand/raw/nand_bbt.c         | 8 ++++----
  29  drivers/mtd/nand/raw/sm_common.c        | 2 +-
  30  drivers/mtd/nftlcore.c                  | 6 +++---
  31  drivers/mtd/sm_ftl.c                    | 4 ++--
  32  drivers/mtd/ssfdc.c                     | 2 +-
  33  drivers/mtd/tests/nandbiterrs.c         | 2 +-
  34  drivers/mtd/tests/oobtest.c             | 8 ++++----
  35  drivers/mtd/tests/readtest.c            | 2 +-
  36  fs/jffs2/wbuf.c                         | 6 +++---
  37  13 files changed, 29 insertions(+), 29 deletions(-)
  38
  39 --- a/drivers/mtd/inftlcore.c
  40 +++ b/drivers/mtd/inftlcore.c
  41 @@ -136,7 +136,7 @@ static void inftl_remove_dev(struct mtd_
  42  int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
  43                    size_t *retlen, uint8_t *buf)
  44  {
  45 -       struct mtd_oob_ops ops;
  46 +       struct mtd_oob_ops ops = { };
  47         int res;
  48
  49         ops.mode = MTD_OPS_PLACE_OOB;
  50 @@ -156,7 +156,7 @@ int inftl_read_oob(struct mtd_info *mtd,
  51  int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
  52                     size_t *retlen, uint8_t *buf)
  53  {
  54 -       struct mtd_oob_ops ops;
  55 +       struct mtd_oob_ops ops = { };
  56         int res;
  57
  58         ops.mode = MTD_OPS_PLACE_OOB;
  59 @@ -176,7 +176,7 @@ int inftl_write_oob(struct mtd_info *mtd
  60  static int inftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
  61                        size_t *retlen, uint8_t *buf, uint8_t *oob)
  62  {
  63 -       struct mtd_oob_ops ops;
  64 +       struct mtd_oob_ops ops = { };
  65         int res;
  66
  67         ops.mode = MTD_OPS_PLACE_OOB;
  68 --- a/drivers/mtd/mtdswap.c
  69 +++ b/drivers/mtd/mtdswap.c
  70 @@ -323,7 +323,7 @@ static int mtdswap_read_markers(struct m
  71         struct mtdswap_oobdata *data, *data2;
  72         int ret;
  73         loff_t offset;
  74 -       struct mtd_oob_ops ops;
  75 +       struct mtd_oob_ops ops = { };
  76
  77         offset = mtdswap_eb_offset(d, eb);
  78
  79 @@ -370,7 +370,7 @@ static int mtdswap_write_marker(struct m
  80         struct mtdswap_oobdata n;
  81         int ret;
  82         loff_t offset;
  83 -       struct mtd_oob_ops ops;
  84 +       struct mtd_oob_ops ops = { };
  85
  86         ops.ooboffs = 0;
  87         ops.oobbuf = (uint8_t *)&n;
  88 @@ -879,7 +879,7 @@ static unsigned int mtdswap_eblk_passes(
  89         loff_t base, pos;
  90         unsigned int *p1 = (unsigned int *)d->page_buf;
  91         unsigned char *p2 = (unsigned char *)d->oob_buf;
  92 -       struct mtd_oob_ops ops;
  93 +       struct mtd_oob_ops ops = { };
  94         int ret;
  95
  96         ops.mode = MTD_OPS_AUTO_OOB;
  97 --- a/drivers/mtd/nand/onenand/onenand_base.c
  98 +++ b/drivers/mtd/nand/onenand/onenand_base.c
  99 @@ -2935,7 +2935,7 @@ static int do_otp_write(struct mtd_info
 100         struct onenand_chip *this = mtd->priv;
 101         unsigned char *pbuf = buf;
 102         int ret;
 103 -       struct mtd_oob_ops ops;
 104 +       struct mtd_oob_ops ops = { };
 105
 106         /* Force buffer page aligned */
 107         if (len < mtd->writesize) {
 108 @@ -2977,7 +2977,7 @@ static int do_otp_lock(struct mtd_info *
 109                 size_t *retlen, u_char *buf)
 110  {
 111         struct onenand_chip *this = mtd->priv;
 112 -       struct mtd_oob_ops ops;
 113 +       struct mtd_oob_ops ops = { };
 114         int ret;
 115
 116         if (FLEXONENAND(this)) {
 117 --- a/drivers/mtd/nand/onenand/onenand_bbt.c
 118 +++ b/drivers/mtd/nand/onenand/onenand_bbt.c
 119 @@ -61,7 +61,7 @@ static int create_bbt(struct mtd_info *m
 120         int startblock;
 121         loff_t from;
 122         size_t readlen, ooblen;
 123 -       struct mtd_oob_ops ops;
 124 +       struct mtd_oob_ops ops = { };
 125         int rgn;
 126
 127         printk(KERN_INFO "Scanning device for bad blocks\n");
 128 --- a/drivers/mtd/nand/raw/nand_bbt.c
 129 +++ b/drivers/mtd/nand/raw/nand_bbt.c
 130 @@ -313,7 +313,7 @@ static int scan_read_oob(struct nand_chi
 131                          size_t len)
 132  {
 133         struct mtd_info *mtd = nand_to_mtd(this);
 134 -       struct mtd_oob_ops ops;
 135 +       struct mtd_oob_ops ops = { };
 136         int res, ret = 0;
 137
 138         ops.mode = MTD_OPS_PLACE_OOB;
 139 @@ -354,7 +354,7 @@ static int scan_write_bbt(struct nand_ch
 140                           uint8_t *buf, uint8_t *oob)
 141  {
 142         struct mtd_info *mtd = nand_to_mtd(this);
 143 -       struct mtd_oob_ops ops;
 144 +       struct mtd_oob_ops ops = { };
 145
 146         ops.mode = MTD_OPS_PLACE_OOB;
 147         ops.ooboffs = 0;
 148 @@ -416,7 +416,7 @@ static int scan_block_fast(struct nand_c
 149  {
 150         struct mtd_info *mtd = nand_to_mtd(this);
 151
 152 -       struct mtd_oob_ops ops;
 153 +       struct mtd_oob_ops ops = { };
 154         int ret, page_offset;
 155
 156         ops.ooblen = mtd->oobsize;
 157 @@ -756,7 +756,7 @@ static int write_bbt(struct nand_chip *t
 158         uint8_t rcode = td->reserved_block_code;
 159         size_t retlen, len = 0;
 160         loff_t to;
 161 -       struct mtd_oob_ops ops;
 162 +       struct mtd_oob_ops ops = { };
 163
 164         ops.ooblen = mtd->oobsize;
 165         ops.ooboffs = 0;
 166 --- a/drivers/mtd/nand/raw/sm_common.c
 167 +++ b/drivers/mtd/nand/raw/sm_common.c
 168 @@ -99,7 +99,7 @@ static const struct mtd_ooblayout_ops oo
 169  static int sm_block_markbad(struct nand_chip *chip, loff_t ofs)
 170  {
 171         struct mtd_info *mtd = nand_to_mtd(chip);
 172 -       struct mtd_oob_ops ops;
 173 +       struct mtd_oob_ops ops = { };
 174         struct sm_oob oob;
 175         int ret;
 176
 177 --- a/drivers/mtd/nftlcore.c
 178 +++ b/drivers/mtd/nftlcore.c
 179 @@ -124,7 +124,7 @@ int nftl_read_oob(struct mtd_info *mtd,
 180                   size_t *retlen, uint8_t *buf)
 181  {
 182         loff_t mask = mtd->writesize - 1;
 183 -       struct mtd_oob_ops ops;
 184 +       struct mtd_oob_ops ops = { };
 185         int res;
 186
 187         ops.mode = MTD_OPS_PLACE_OOB;
 188 @@ -145,7 +145,7 @@ int nftl_write_oob(struct mtd_info *mtd,
 189                    size_t *retlen, uint8_t *buf)
 190  {
 191         loff_t mask = mtd->writesize - 1;
 192 -       struct mtd_oob_ops ops;
 193 +       struct mtd_oob_ops ops = { };
 194         int res;
 195
 196         ops.mode = MTD_OPS_PLACE_OOB;
 197 @@ -168,7 +168,7 @@ static int nftl_write(struct mtd_info *m
 198                       size_t *retlen, uint8_t *buf, uint8_t *oob)
 199  {
 200         loff_t mask = mtd->writesize - 1;
 201 -       struct mtd_oob_ops ops;
 202 +       struct mtd_oob_ops ops = { };
 203         int res;
 204
 205         ops.mode = MTD_OPS_PLACE_OOB;
 206 --- a/drivers/mtd/sm_ftl.c
 207 +++ b/drivers/mtd/sm_ftl.c
 208 @@ -239,7 +239,7 @@ static int sm_read_sector(struct sm_ftl
 209                           uint8_t *buffer, struct sm_oob *oob)
 210  {
 211         struct mtd_info *mtd = ftl->trans->mtd;
 212 -       struct mtd_oob_ops ops;
 213 +       struct mtd_oob_ops ops = { };
 214         struct sm_oob tmp_oob;
 215         int ret = -EIO;
 216         int try = 0;
 217 @@ -323,7 +323,7 @@ static int sm_write_sector(struct sm_ftl
 218                            int zone, int block, int boffset,
 219                            uint8_t *buffer, struct sm_oob *oob)
 220  {
 221 -       struct mtd_oob_ops ops;
 222 +       struct mtd_oob_ops ops = { };
 223         struct mtd_info *mtd = ftl->trans->mtd;
 224         int ret;
 225
 226 --- a/drivers/mtd/ssfdc.c
 227 +++ b/drivers/mtd/ssfdc.c
 228 @@ -163,7 +163,7 @@ static int read_physical_sector(struct m
 229  /* Read redundancy area (wrapper to MTD_READ_OOB */
 230  static int read_raw_oob(struct mtd_info *mtd, loff_t offs, uint8_t *buf)
 231  {
 232 -       struct mtd_oob_ops ops;
 233 +       struct mtd_oob_ops ops = { };
 234         int ret;
 235
 236         ops.mode = MTD_OPS_RAW;
 237 --- a/drivers/mtd/tests/nandbiterrs.c
 238 +++ b/drivers/mtd/tests/nandbiterrs.c
 239 @@ -99,7 +99,7 @@ static int write_page(int log)
 240  static int rewrite_page(int log)
 241  {
 242         int err = 0;
 243 -       struct mtd_oob_ops ops;
 244 +       struct mtd_oob_ops ops = { };
 245
 246         if (log)
 247                 pr_info("rewrite page\n");
 248 --- a/drivers/mtd/tests/oobtest.c
 249 +++ b/drivers/mtd/tests/oobtest.c
 250 @@ -56,7 +56,7 @@ static void do_vary_offset(void)
 251  static int write_eraseblock(int ebnum)
 252  {
 253         int i;
 254 -       struct mtd_oob_ops ops;
 255 +       struct mtd_oob_ops ops = { };
 256         int err = 0;
 257         loff_t addr = (loff_t)ebnum * mtd->erasesize;
 258
 259 @@ -165,7 +165,7 @@ static size_t memffshow(loff_t addr, lof
 260  static int verify_eraseblock(int ebnum)
 261  {
 262         int i;
 263 -       struct mtd_oob_ops ops;
 264 +       struct mtd_oob_ops ops = { };
 265         int err = 0;
 266         loff_t addr = (loff_t)ebnum * mtd->erasesize;
 267         size_t bitflips;
 268 @@ -260,7 +260,7 @@ static int verify_eraseblock(int ebnum)
 269
 270  static int verify_eraseblock_in_one_go(int ebnum)
 271  {
 272 -       struct mtd_oob_ops ops;
 273 +       struct mtd_oob_ops ops = { };
 274         int err = 0;
 275         loff_t addr = (loff_t)ebnum * mtd->erasesize;
 276         size_t len = mtd->oobavail * pgcnt;
 277 @@ -338,7 +338,7 @@ static int __init mtd_oobtest_init(void)
 278         int err = 0;
 279         unsigned int i;
 280         uint64_t tmp;
 281 -       struct mtd_oob_ops ops;
 282 +       struct mtd_oob_ops ops = { };
 283         loff_t addr = 0, addr0;
 284
 285         printk(KERN_INFO "\n");
 286 --- a/drivers/mtd/tests/readtest.c
 287 +++ b/drivers/mtd/tests/readtest.c
 288 @@ -47,7 +47,7 @@ static int read_eraseblock_by_page(int e
 289                                 err = ret;
 290                 }
 291                 if (mtd->oobsize) {
 292 -                       struct mtd_oob_ops ops;
 293 +                       struct mtd_oob_ops ops = { };
 294
 295                         ops.mode      = MTD_OPS_PLACE_OOB;
 296                         ops.len       = 0;
 297 --- a/fs/jffs2/wbuf.c
 298 +++ b/fs/jffs2/wbuf.c
 299 @@ -1035,7 +1035,7 @@ int jffs2_check_oob_empty(struct jffs2_s
 300  {
 301         int i, ret;
 302         int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
 303 -       struct mtd_oob_ops ops;
 304 +       struct mtd_oob_ops ops = { };
 305
 306         ops.mode = MTD_OPS_AUTO_OOB;
 307         ops.ooblen = NR_OOB_SCAN_PAGES * c->oobavail;
 308 @@ -1076,7 +1076,7 @@ int jffs2_check_oob_empty(struct jffs2_s
 309  int jffs2_check_nand_cleanmarker(struct jffs2_sb_info *c,
 310                                  struct jffs2_eraseblock *jeb)
 311  {
 312 -       struct mtd_oob_ops ops;
 313 +       struct mtd_oob_ops ops = { };
 314         int ret, cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
 315
 316         ops.mode = MTD_OPS_AUTO_OOB;
 317 @@ -1101,7 +1101,7 @@ int jffs2_write_nand_cleanmarker(struct
 318                                  struct jffs2_eraseblock *jeb)
 319  {
 320         int ret;
 321 -       struct mtd_oob_ops ops;
 322 +       struct mtd_oob_ops ops = { };
 323         int cmlen = min_t(int, c->oobavail, OOB_CM_SIZE);
 324
 325         ops.mode = MTD_OPS_AUTO_OOB;