Thread (5 messages) read the whole thread 5 messages, 3 authors, 2021-06-11

Re: [PATCH 1/2] mtd: core: fix use of uninitialized struct member

From: Ahmad Fatoum <a.fatoum@pengutronix.de>
Date: 2021-06-11 10:44:21

On 11.06.21 12:23, Sascha Hauer wrote:
Hi Antony,

On Fri, Jun 11, 2021 at 09:39:13AM +0300, Antony Pavlov wrote:
quoted
E.g. mtd_read() calls mtd_read_oob(), mtd_read_oob()
can check uninitialized ops->oobbuf. As a result
mtd_read_oob() can return -EOPNOTSUPP.

Found on a MIPS board during /dev/m25p0 read, e.g.

  barebox:/ md -s /dev/m25p0
  read: error 95

Signed-off-by: Antony Pavlov <redacted>
---
 drivers/mtd/core.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/mtd/core.c b/drivers/mtd/core.c
index 37fccda6be..98820dfb4f 100644
--- a/drivers/mtd/core.c
+++ b/drivers/mtd/core.c
@@ -379,12 +379,13 @@ int mtd_block_markgood(struct mtd_info *mtd, loff_t ofs)
 int mtd_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen,
              u_char *buf)
 {
-	struct mtd_oob_ops ops = {
-		.len = len,
-		.datbuf = buf,
-	};
+	struct mtd_oob_ops ops;
 	int ret;
 
+	memset(&ops, 0, sizeof(ops));
+	ops.len = len;
+	ops.datbuf = buf;
If this fixes something for you then you have severe problems with your
compiler. Omitted fields are implicitly initialized to zero, often you
can even find the corresponding call to memset in the objdump.
Perhaps elsewhere something is interpreting the padding, which may
not be zeroed when using an initializer list. This warrants further investigation
for sure.

Cheers,
Ahmad


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help