From nobody Sat Jul 25 04:55:57 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B17CC3403FE; Fri, 17 Jul 2026 15:39:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302772; cv=none; b=NzQ7UvNAqzeDg6U8g8bgjg+wOoWXkLiGVsAkWPBIEGJIa16xyrDVl1+FLgVxOrL3p+KEROIVOcGIkZMPhwJjuKs966LGDCAlKH2NAdkN27yMCelGEe37A+X6vVe7GZnWvdWubHdmc4rS6BS0XnZL05+QCUPN0VFrJ9NToDcMWI4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302772; c=relaxed/simple; bh=iyBVSLEXGrgKOou1YLMfigS1RsXHcPBpRZVTMx7c8sM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VKAKyrjdrtG0fSrV1t1PU2CshV1pA934wY6WLqH2zVyblWSNLn6E+fT663AvYG2irbOHGbdwUOpkfAq21mw9TjHRopDBae0aJp222Hpfco50gwBCTruV7w/dVA1n2ptkgJS5/Uk/bHuGOAIRTYPxqzaVgpc9pzoiOINV4a+vkI0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: aef2ae4a81f511f1aa26b74ffac11d73-20260717 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:330ff955-1933-47c0-9c9e-8a6e83110d1c,IP:10, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:330ff955-1933-47c0-9c9e-8a6e83110d1c,IP:10,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:1479b18c926dc5008f5f0571dab645c0,BulkI D:2607172339236XID7AL8,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: aef2ae4a81f511f1aa26b74ffac11d73-20260717 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(36.148.177.170)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1500451444; Fri, 17 Jul 2026 23:39:22 +0800 From: Li Qiang To: linux-scsi@vger.kernel.org Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH v2 1/6] scsi: ufs: core: Validate string descriptors Date: Fri, 17 Jul 2026 23:39:08 +0800 Message-ID: <20260717153914.26321-2-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn> References: <20260717153914.26321-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer. Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space. The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer. Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread. Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading") Fixes: d794b499f948 ("scsi: ufs: core: fix incorrect buffer duplication in = ufshcd_read_string_desc()") Signed-off-by: Li Qiang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang --- drivers/ufs/core/ufshcd.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index d3044a3089b5..3541da5b6f4d 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -3865,7 +3865,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 d= esc_index, u8 **buf, enum u { struct uc_string_id *uc_str; u8 *str; - int ret; + int ret, uc_len; =20 if (!buf) return -EINVAL; @@ -3890,11 +3890,19 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8= desc_index, u8 **buf, enum u goto out; } =20 + uc_len =3D uc_str->len - QUERY_DESC_HDR_SIZE; + if (uc_len % sizeof(*uc_str->uc)) { + dev_err(hba->dev, "String Desc has an odd UTF-16 payload length\n"); + str =3D NULL; + ret =3D -EINVAL; + goto out; + } + if (fmt =3D=3D SD_ASCII_STD) { ssize_t ascii_len; int i; - /* remove header and divide by 2 to move from UTF16 to UTF8 */ - ascii_len =3D (uc_str->len - QUERY_DESC_HDR_SIZE) / 2 + 1; + /* Allow up to three UTF-8 bytes per UTF-16 code unit plus a NUL. */ + ascii_len =3D uc_len / sizeof(*uc_str->uc) * 3 + 1; str =3D kzalloc(ascii_len, GFP_KERNEL); if (!str) { ret =3D -ENOMEM; @@ -3906,7 +3914,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 d= esc_index, u8 **buf, enum u * we need to convert to utf-8 so it can be displayed */ ret =3D utf16s_to_utf8s(uc_str->uc, - uc_str->len - QUERY_DESC_HDR_SIZE, + uc_len / sizeof(*uc_str->uc), UTF16_BIG_ENDIAN, str, ascii_len - 1); =20 /* replace non-printable or non-ASCII characters with spaces */ @@ -3916,11 +3924,17 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8= desc_index, u8 **buf, enum u str[ret++] =3D '\0'; =20 } else { - str =3D kmemdup(uc_str->uc, uc_str->len, GFP_KERNEL); + /* + * Keep the bLength-sized raw output for the RPMB device ID ABI. + * The two bytes beyond the UTF-16 payload are explicitly zeroed + * instead of being read past the descriptor buffer. + */ + str =3D kzalloc(uc_str->len, GFP_KERNEL); if (!str) { ret =3D -ENOMEM; goto out; } + memcpy(str, uc_str->uc, uc_len); ret =3D uc_str->len; } out: --=20 2.43.0 From nobody Sat Jul 25 04:55:57 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B15D33431F5; Fri, 17 Jul 2026 15:39:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302774; cv=none; b=qiEK0sxgDnaEVlz6EMnHqSBBSPEvx+1mJCcy7ywyVPHG+vzLtAfSWckTvSRNTzfQq+UvidEVq+fu2alr1cqGZVNevA5woYw/MDdfCuJebbai4lv+nYqTJHdiBd5cWPQquJnNBg48X0O4biNmGlUNfhPgK9ATFjL/kGQ2Q/G4ixo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302774; c=relaxed/simple; bh=q7QRYf46sB8tTr6KtwkIa7G1amqSmOQCtKSG/gIiFxA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sjt7nQrvxqtkTgGSJcaHTTQCzSbf7HflhWh2HOKPhnFxbfSkcV+twJLdlgRNHrmv8lJwi+7yWZFyAs39uV4+APGakUXS6v0mGFsy4paCq8yc9n+XuKPlSbOPRwi+uiDYE1Vjvd+hQNUP/u4FPCtflNZYk5I8vLKuSnqQnAVjx+0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: b082ee3281f511f1aa26b74ffac11d73-20260717 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:fb181998-a7a4-4324-87da-31ac1409716c,IP:10, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:fb181998-a7a4-4324-87da-31ac1409716c,IP:10,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:1b678ea77aa8a6225db9755f3d9150ce,BulkI D:2607172339262CVU7MKK,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 136|865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:n il,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0 ,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: b082ee3281f511f1aa26b74ffac11d73-20260717 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(36.148.177.170)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1921946345; Fri, 17 Jul 2026 23:39:25 +0800 From: Li Qiang To: linux-scsi@vger.kernel.org Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH v2 2/6] scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags Date: Fri, 17 Jul 2026 23:39:09 +0800 Message-ID: <20260717153914.26321-3-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn> References: <20260717153914.26321-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error. Avoid that dereference and include the invalid tag in the warning. Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path") Signed-off-by: Li Qiang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang --- drivers/ufs/core/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 3541da5b6f4d..d1b989abc9e2 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -5860,8 +5860,8 @@ void ufshcd_compl_one_cqe(struct ufs_hba *hba, int ta= sk_tag, struct ufshcd_lrb *lrbp =3D scsi_cmd_priv(cmd); enum utp_ocs ocs; =20 - if (WARN_ONCE(!cmd, "cqe->command_desc_base_addr =3D %#llx\n", - le64_to_cpu(cqe->command_desc_base_addr))) + if (WARN_ONCE(!cmd, "invalid completion tag %d, cqe->command_desc_base_ad= dr =3D %#llx\n", + task_tag, cqe ? le64_to_cpu(cqe->command_desc_base_addr) : 0ULL)) return; =20 if (hba->monitor.enabled) { --=20 2.43.0 From nobody Sat Jul 25 04:55:57 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 213A43546F8; Fri, 17 Jul 2026 15:39:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302778; cv=none; b=hj4xHya7lCfq52i0ULQk7XajE0yyP+6hnuOOyaruaI7lAcG2hDSTfIGDNTx6fAblNdCn+qWunyLLH580qFKxT/MIw6xF6oovfkth1ccpseBv8l+LvtwolZs2jA9YXxIxYKcNGl/Fo1ZKIRewM/7BthRg2V2UNIkPdHPjjpEbA2w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302778; c=relaxed/simple; bh=N9V267Z6ilpa68gOCCF1mhYpf9dThBx3L1HSyRADHkA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zao+tFFgk8w5zJnNAENrIgwFroax3fQ/LO8ml5ahnK/6IbZRLvcoir7oUUbVhEM+GzdkwUFhh+VxCI1Hi6PKvizPDavwywCdYTXUjegofQ08y7UuxWlN0kWUQibB87422v8xmkP6vDX39m7pNuYwXW4r5f+EzA2TZ9uRvuGzXuc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: b28b02b481f511f1aa26b74ffac11d73-20260717 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:6f021a33-231e-421d-b9ac-365ece44ba37,IP:10, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:6f021a33-231e-421d-b9ac-365ece44ba37,IP:10,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:e8c1d69296f270e7d48c10a2d6366b0f,BulkI D:260717233929GNM25IE2,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: b28b02b481f511f1aa26b74ffac11d73-20260717 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(36.148.177.170)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 344467571; Fri, 17 Jul 2026 23:39:28 +0800 From: Li Qiang To: linux-scsi@vger.kernel.org Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH v2 3/6] scsi: ufs: core: Validate connected lane counts Date: Fri, 17 Jul 2026 23:39:10 +0800 Message-ID: <20260717153914.26321-4-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn> References: <20260717153914.26321-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated. Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Signed-off-by: Li Qiang --- drivers/ufs/core/ufshcd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index d1b989abc9e2..bbadddcd661a 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -4729,7 +4729,9 @@ static int ufshcd_get_max_pwr_mode(struct ufs_hba *hb= a) ufshcd_dme_get(hba, UIC_ARG_MIB(PA_CONNECTEDTXDATALANES), &pwr_info->lane_tx); =20 - if (!pwr_info->lane_rx || !pwr_info->lane_tx) { + if (!pwr_info->lane_rx || !pwr_info->lane_tx || + pwr_info->lane_rx > UFS_MAX_LANES || + pwr_info->lane_tx > UFS_MAX_LANES) { dev_err(hba->dev, "%s: invalid connected lanes value. rx=3D%d, tx=3D%d\n= ", __func__, pwr_info->lane_rx, --=20 2.43.0 From nobody Sat Jul 25 04:55:57 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 368E63438B7; Fri, 17 Jul 2026 15:39:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302785; cv=none; b=ZWtPOCVmIQEEIiC9SMwrA+KXEaIQFtjoe0vWlRrbJmBnIVACZYRKBtcRVNhFry9++KG8BKNFPywivdw+W0d0p22VyWrA1lIQ0RXn1/is4g/x6W2Dcofoeiu2S9qjVIcCZ6TCtSdYIqyoKMEpcqWbei6X9nXF68Uum4JtAtasHbY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302785; c=relaxed/simple; bh=Xma1lxJI48/B0CdK8BFBLbD9QZANuxsPicuWajj5Oj4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LfQjUuxcSlAxBGVm23y8FIqCJOnws79NXstPfJEvEDb1Nx9u5KzixkoULYPhhgE01iBwE6zhhDM3gVFCN6Yasq/yq1mMtVp7tlG/LWNonOHGePwIT+KxNrnutYMdRj1QCMtiM4zx2lVleL9SaBI01eCzir1cUlUp4ETvbstHyvY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: b4a50d8881f511f1aa26b74ffac11d73-20260717 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:89ec708e-1a52-4d70-9908-9d812f0d0d3b,IP:10, URL:0,TC:0,Content:-5,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:30 X-CID-INFO: VERSION:1.3.12,REQID:89ec708e-1a52-4d70-9908-9d812f0d0d3b,IP:10,UR L:0,TC:0,Content:-5,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:30 X-CID-META: VersionHash:e7bac3a,CLOUDID:4128ba73d883d8b9e89b98fe5678d02e,BulkI D:2607172339322OSQSSQX,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 136|865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:n il,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0 ,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: b4a50d8881f511f1aa26b74ffac11d73-20260717 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(36.148.177.170)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 86080656; Fri, 17 Jul 2026 23:39:32 +0800 From: Li Qiang To: linux-scsi@vger.kernel.org Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH v2 4/6] scsi: ufs: rpmb: Validate request frame length before parsing Date: Fri, 17 Jul 2026 23:39:11 +0800 Message-ID: <20260717153914.26321-5-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn> References: <20260717153914.26321-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The RPMB core only verifies that request and response buffers are nonempty. This callback reads req_resp at the end of the first request frame before validating the request length. Require a complete frame before that access. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS= devices") Signed-off-by: Li Qiang Reviewed-by: Bean Huo Reviewed-by: Peter Wang --- drivers/ufs/core/ufs-rpmb.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c index ffad049872b9..431f85b36876 100644 --- a/drivers/ufs/core/ufs-rpmb.c +++ b/drivers/ufs/core/ufs-rpmb.c @@ -69,6 +69,10 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 = *req, unsigned int req_l =20 hba =3D ufs_rpmb->hba; =20 + /* req_resp is at the end of an RPMB frame. */ + if (req_len < sizeof(*frm_out)) + return -EINVAL; + req_type =3D be16_to_cpu(frm_out->req_resp); =20 switch (req_type) { --=20 2.43.0 From nobody Sat Jul 25 04:55:57 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 089C0367F26; Fri, 17 Jul 2026 15:39:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302785; cv=none; b=NkcQctwttnzpdDudRkxdN+aV6GOr7ulUajPGb83GVIJhQk127GcSBCunXdDaS92SeMyHUipzNOa7EJU9Q536uTtAhJ0Rl5DtGtA8HEChSTA98l4NRyNxzHwwGNLdA6wAhC8OaiilB/omGpSTKZxnLlIjEdb4f8hJGir2OQNgZ4s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302785; c=relaxed/simple; bh=yU2xbCaoZNStlsFxUYW5hUX1bWR5QLoHSQqtPhxddLU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JJ9HEKEUoyPgBzYGbXn+1eRWvsUOi9/3zspoBUqQYsvPUOtxH8ZK47PoEbsCi2orfdw7gs5DDsuEfi5ka8+xD8D+cWEOYR2quSr6kiv4H+II9AQAxUF70PhJtFNwcqN2+xLbP4iA0ggBBym+Q1vT8Eh2u+tgK3i6ngDR1GBx6JY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: b62888ec81f511f1aa26b74ffac11d73-20260717 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:ae611860-979a-4178-9bcd-60614607ebe4,IP:10, URL:0,TC:0,Content:-5,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:30 X-CID-INFO: VERSION:1.3.12,REQID:ae611860-979a-4178-9bcd-60614607ebe4,IP:10,UR L:0,TC:0,Content:-5,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:30 X-CID-META: VersionHash:e7bac3a,CLOUDID:d658da891c7d306f38e2fd0b8323e121,BulkI D:260717233935CX29LHP2,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: b62888ec81f511f1aa26b74ffac11d73-20260717 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(36.148.177.170)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 371168088; Fri, 17 Jul 2026 23:39:34 +0800 From: Li Qiang To: linux-scsi@vger.kernel.org Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH v2 5/6] scsi: ufs: rpmb: Use unaligned accessors for RPMB frames Date: Fri, 17 Jul 2026 23:39:12 +0800 Message-ID: <20260717153914.26321-6-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn> References: <20260717153914.26321-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" RPMB frame buffers are passed as u8 pointers and do not have an alignment guarantee. Use unaligned accessors for the req_resp field. Signed-off-by: Li Qiang Reviewed-by: Peter Wang --- drivers/ufs/core/ufs-rpmb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c index 431f85b36876..53f66b274aca 100644 --- a/drivers/ufs/core/ufs-rpmb.c +++ b/drivers/ufs/core/ufs-rpmb.c @@ -73,7 +73,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *= req, unsigned int req_l if (req_len < sizeof(*frm_out)) return -EINVAL; =20 - req_type =3D be16_to_cpu(frm_out->req_resp); + req_type =3D get_unaligned_be16(&frm_out->req_resp); =20 switch (req_type) { case RPMB_PROGRAM_KEY: @@ -111,7 +111,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8= *req, unsigned int req_l struct rpmb_frame *frm_resp =3D (struct rpmb_frame *)resp; =20 memset(frm_resp, 0, sizeof(*frm_resp)); - frm_resp->req_resp =3D cpu_to_be16(RPMB_RESULT_READ); + put_unaligned_be16(RPMB_RESULT_READ, &frm_resp->req_resp); ret =3D ufs_sec_submit(hba, protocol_id, resp, resp_len, true); if (ret) { dev_err(dev, "Result read request failed with ret=3D%d\n", ret); --=20 2.43.0 From nobody Sat Jul 25 04:55:57 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A623633E348; Fri, 17 Jul 2026 15:39:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302791; cv=none; b=DQDWIwgCzmVUBnipa5J7MQmEr74oUc00Ab/fMu5MtmkW2yeggDe8YdyNcPZH6kK+Q5LCHT4+jxCGik7iwphssLF3NYJlCamTuhdtwzdWDvWEhQ8SsAfKhZTPo2/6BHHK2nRr9j1L8U9NaesnpfFooBoIHS7TOxFVJrbZGhEd5BE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784302791; c=relaxed/simple; bh=Z6oh0Aq5J0HC92QSmxmgcuwDkCdEfj4l2FJAyi1z5Uw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=na8ZnpSnmbLKklTW2jjvO65hv8qvcZMXazpXsQsv9E3boYHx873STuFUcKAXsWaUkTc7WW3Zvv+APfRWx9nvljtxJD/0eHgu2oilAEq33G/hw+7eLCvdXJXGyq2ziPTHgUYsXRSL4Qv1tNG/8L1pC8uy7QXrDKFPLgny5x0vGmE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: b80c4c8481f511f1aa26b74ffac11d73-20260717 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:33fca415-e321-4e80-9423-80f37d191bf8,IP:10, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:35 X-CID-INFO: VERSION:1.3.12,REQID:33fca415-e321-4e80-9423-80f37d191bf8,IP:10,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:35 X-CID-META: VersionHash:e7bac3a,CLOUDID:ce9d4801fc87a208fe06f4bc3542b35d,BulkI D:260717233941M7C6XWU3,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: b80c4c8481f511f1aa26b74ffac11d73-20260717 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(36.148.177.170)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1100195280; Fri, 17 Jul 2026 23:39:37 +0800 From: Li Qiang To: linux-scsi@vger.kernel.org Cc: bvanassche@acm.org, linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH v2 6/6] scsi: ufs: debugfs: Reserve space for a string terminator Date: Fri, 17 Jul 2026 23:39:13 +0800 Message-ID: <20260717153914.26321-7-liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260717153914.26321-1-liqiang01@kylinos.cn> References: <20260717153914.26321-1-liqiang01@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL. Fixes: 7340faae9474 ("scsi: ufs: core: Add debugfs attributes for triggerin= g the UFS EH") Signed-off-by: Li Qiang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang --- drivers/ufs/core/ufs-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ufs/core/ufs-debugfs.c b/drivers/ufs/core/ufs-debugfs.c index e3dd81d6fe82..be527209540d 100644 --- a/drivers/ufs/core/ufs-debugfs.c +++ b/drivers/ufs/core/ufs-debugfs.c @@ -165,7 +165,7 @@ static ssize_t ufs_saved_err_write(struct file *file, c= onst char __user *buf, char val_str[16] =3D { }; int val, ret; =20 - if (count > sizeof(val_str)) + if (count >=3D sizeof(val_str)) return -EINVAL; if (copy_from_user(val_str, buf, count)) return -EFAULT; --=20 2.43.0