Ivan Stepchenko 1cda594dfa mtd: onenand: Fix uninitialized retlen in do_otp_read() ...

commit 70a71f8151 upstream.

The function do_otp_read() does not set the output parameter *retlen,
which is expected to contain the number of bytes actually read.
As a result, in onenand_otp_walk(), the tmp_retlen variable remains
uninitialized after calling do_otp_walk() and used to change
the values of the buf, len and retlen variables.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 49dc08eeda ("[MTD] [OneNAND] fix numerous races")
Cc: stable@vger.kernel.org
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-17 10:05:41 +01:00

..

chips

mtd: add missing MODULE_DESCRIPTION() macros

2024-07-01 11:56:28 +02:00

devices

mtd: powernv: Add check devm_kasprintf() returned value

2024-09-06 17:10:08 +02:00

hyperbus

mtd: hyperbus: hbmc-am654: fix an OF node reference leak

2025-02-08 09:57:54 +01:00

lpddr

mtd: lpddr2_nvm: Convert to platform remove callback returning void

2023-10-16 10:56:48 +02:00

maps

mtd: add missing MODULE_DESCRIPTION() macros

2024-07-01 11:56:28 +02:00

nand

mtd: onenand: Fix uninitialized retlen in do_otp_read()

2025-02-17 10:05:41 +01:00

parsers

mtd: parsers: bcm47xxpart: make read-only array possible_nvram_sizes static const

2024-08-23 19:25:49 +02:00

spi-nor

Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"

2025-01-23 17:22:53 +01:00

tests

mtd: make mtd_test.c a separate module

2024-07-01 11:56:25 +02:00

ubi

ubi: Add a check for ubi_num

2025-02-17 10:05:24 +01:00

ftl.c

mtd: ftl: use container_of() rather than cast

2022-09-19 18:14:53 +02:00

inftlcore.c

mtd: inftlcore: fix repeated words in comments

2022-11-07 17:14:21 +01:00

inftlmount.c

mtd: inftl: remove unnecessary oom message

2021-06-11 20:44:21 +02:00

Kconfig

mtdblock: Add comment about UBI block devices

2021-08-06 22:05:13 +02:00

Makefile

mtd: Support kmsg dumper based on pstore/blk

2020-05-31 19:49:01 -07:00

mtd_blkdevs.c

block: move the add_random flag to queue_limits

2024-06-19 07:58:28 -06:00

mtdblock_ro.c

mtdblock: make warning messages ratelimited

2023-07-27 17:16:14 +02:00

mtdblock.c

mtdblock: make warning messages ratelimited

2023-07-27 17:16:14 +02:00

mtdchar.c

mtdchar: mark bits of ioctl handler noinline

2023-06-01 18:12:31 +02:00

mtdconcat.c

mtd: concat: Use kmemdup_array instead of kmemdup for multiple allocation

2024-08-23 19:25:51 +02:00

mtdcore.c

Merge tag 'mtd/for-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2024-05-16 09:04:52 -07:00

mtdcore.h

mtd: use refcount to prevent corruption

2023-07-12 13:30:08 +02:00

mtdoops.c

mtd: mtdoops: Fix kmsgdump parameter renaming.

2024-07-22 17:56:22 +02:00

mtdpart.c

mtd: mtdpart: check for subpartitions parsing result

2023-10-16 10:50:32 +02:00

mtdpstore.c

mtd: Fix a typo in a comment

2022-09-19 18:14:53 +02:00

mtdsuper.c

mtd: key superblock by device number

2023-08-31 12:47:15 +02:00

mtdswap.c

mtd: always initialize 'stats' in struct mtd_oob_ops

2022-09-21 10:38:07 +02:00

nftlcore.c

mtd: always initialize 'stats' in struct mtd_oob_ops

2022-09-21 10:38:07 +02:00

nftlmount.c

mtd: nftl: remove unnecessary oom message

2021-06-11 20:43:26 +02:00

rfd_ftl.c

mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev

2021-08-23 10:01:06 +02:00

sm_ftl.c

mtd: sm_ftl: Fix typos in comments

2023-06-22 23:00:43 +02:00

sm_ftl.h

…

ssfdc.c

mtd: ssfdc: Improve a size determination in ssfdcr_add_mtd()

2024-02-05 14:22:39 +01:00