lkml.org 
[lkml]   [2022]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 106/132] scsi: ufs: core: Fix referencing invalid rsp field
    Date
    From: Daejun Park <daejun7.park@samsung.com>

    [ Upstream commit d5d92b64408443e113b9742f8f1c35278910dd4d ]

    Fix referencing sense data when it is invalid. When the length of the data
    segment is 0, there is no valid information in the rsp field, so
    ufshpb_rsp_upiu() is returned without additional operation.

    Link: https://lore.kernel.org/r/252651381.41652940482659.JavaMail.epsvc@epcpadp4
    Fixes: 4b5f49079c52 ("scsi: ufs: ufshpb: L2P map management for HPB read")
    Acked-by: Avri Altman <avri.altman@wdc.com>
    Signed-off-by: Daejun Park <daejun7.park@samsung.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/ufs/ufshpb.c | 19 +++++++------------
    1 file changed, 7 insertions(+), 12 deletions(-)

    diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c
    index f7eaf64293a4..14300896c57f 100644
    --- a/drivers/scsi/ufs/ufshpb.c
    +++ b/drivers/scsi/ufs/ufshpb.c
    @@ -1257,6 +1257,13 @@ void ufshpb_rsp_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
    struct utp_hpb_rsp *rsp_field = &lrbp->ucd_rsp_ptr->hr;
    int data_seg_len;

    + data_seg_len = be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_2)
    + & MASK_RSP_UPIU_DATA_SEG_LEN;
    +
    + /* If data segment length is zero, rsp_field is not valid */
    + if (!data_seg_len)
    + return;
    +
    if (unlikely(lrbp->lun != rsp_field->lun)) {
    struct scsi_device *sdev;
    bool found = false;
    @@ -1291,18 +1298,6 @@ void ufshpb_rsp_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
    return;
    }

    - data_seg_len = be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_2)
    - & MASK_RSP_UPIU_DATA_SEG_LEN;
    -
    - /* To flush remained rsp_list, we queue the map_work task */
    - if (!data_seg_len) {
    - if (!ufshpb_is_general_lun(hpb->lun))
    - return;
    -
    - ufshpb_kick_map_work(hpb);
    - return;
    - }
    -
    BUILD_BUG_ON(sizeof(struct utp_hpb_rsp) != UTP_HPB_RSP_SIZE);

    if (!ufshpb_is_hpb_rsp_valid(hba, lrbp, rsp_field))
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-05-23 19:44    [W:4.090 / U:0.232 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site