Ivan Stepchenko 1cda594dfa mtd: onenand: Fix uninitialized retlen in do_otp_read() ...

commit 70a71f8151 upstream.

The function do_otp_read() does not set the output parameter *retlen,
which is expected to contain the number of bytes actually read.
As a result, in onenand_otp_walk(), the tmp_retlen variable remains
uninitialized after calling do_otp_walk() and used to change
the values of the buf, len and retlen variables.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 49dc08eeda ("[MTD] [OneNAND] fix numerous races")
Cc: stable@vger.kernel.org
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-17 10:05:41 +01:00

..

chips

…

devices

mtd: powernv: Add check devm_kasprintf() returned value

2024-09-06 17:10:08 +02:00

hyperbus

mtd: hyperbus: hbmc-am654: fix an OF node reference leak

2025-02-08 09:57:54 +01:00

lpddr

…

maps

…

nand

mtd: onenand: Fix uninitialized retlen in do_otp_read()

2025-02-17 10:05:41 +01:00

parsers

…

spi-nor

Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"

2025-01-23 17:22:53 +01:00

tests

…

ubi

ubi: Add a check for ubi_num

2025-02-17 10:05:24 +01:00

ftl.c

…

inftlcore.c

…

inftlmount.c

…

Kconfig

…

Makefile

…

mtd_blkdevs.c

…

mtdblock_ro.c

…

mtdblock.c

…

mtdchar.c

…

mtdconcat.c

…

mtdcore.c

…

mtdcore.h

…

mtdoops.c

…

mtdpart.c

…

mtdpstore.c

…

mtdsuper.c

…

mtdswap.c

…

nftlcore.c

…

nftlmount.c

…

rfd_ftl.c

…

sm_ftl.c

…

sm_ftl.h

…

ssfdc.c

…