[v2] scsi: ufs: Fix descriptor parsing and invalid input handling

[PATCH v2 0/6] scsi: ufs: Fix descriptor parsing and invalid input handling

Li Qiang posted 6 patches 1 week ago

Diff against v1
Download series mbox

drivers/ufs/core/ufs-debugfs.c |  2 +-
drivers/ufs/core/ufs-rpmb.c    |  8 ++++++--
drivers/ufs/core/ufshcd.c      | 32 ++++++++++++++++++++++++--------
3 files changed, 31 insertions(+), 11 deletions(-)

Expand all Fold all

[PATCH v2 0/6] scsi: ufs: Fix descriptor parsing and invalid input handling

Posted by Li Qiang 1 week ago

The first patch validates string descriptor payload sizes and avoids raw
descriptor overreads. The remaining patches protect invalid completion
diagnostics, validate connected lane counts, validate RPMB frame sizes,
use unaligned RPMB frame accesses, and retain a NUL terminator for
debugfs input.

Changes in v2:
- Reworked patch 2 as requested: drop changes to the safe
  scsi_cmd_priv(NULL) and scsi_cmd_to_rq(NULL) calls and retain only the
  invalid-CQE diagnostic fix.
- Split the previous RPMB patch into a request-length validation patch
  and an independent unaligned-access patch.

Li Qiang (6):
  scsi: ufs: core: Validate string descriptors
  scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags
  scsi: ufs: core: Validate connected lane counts
  scsi: ufs: rpmb: Validate request frame length before parsing
  scsi: ufs: rpmb: Use unaligned accessors for RPMB frames
  scsi: ufs: debugfs: Reserve space for a string terminator

 drivers/ufs/core/ufs-debugfs.c |  2 +-
 drivers/ufs/core/ufs-rpmb.c    |  8 ++++++--
 drivers/ufs/core/ufshcd.c      | 32 ++++++++++++++++++++++++--------
 3 files changed, 31 insertions(+), 11 deletions(-)

-- 
2.43.0