From nobody Sat Jul 25 16:19:15 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85D5F221FCD; Thu, 16 Jul 2026 06:20:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182842; cv=none; b=DrhnF3/wQ1ELAnJ4s22Dn8qZ3BpHYolznPGbh582T1iXJC9Jph5xdNEARjTQKwj8wte9FGapnY4fA/HEP4i6RLtC5mFnJw9XnBsf/SPzm4ziqMZc1Bl09EDMo75zvh8Pe0Hwriabb/TiVXecMXr08VNdzVbEprhQzF4uUjLYkl8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182842; c=relaxed/simple; bh=tCpoL5XK5VY0OlZKps6GfpgB1lIofIitQjnMPq3rt+Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oOO1reMhmY7nv5jcfZoB+NINHwbiULyBwMEXfZ1FpvT5LPWlrC6h248dTCxKmkkAMh+lVVZu7egmPLCV0mQMhcLVVTzs6Vdh4ed2Zgl8ikOt/JY/P2S/srz/uHywRSWkXu9e2keNSdQHxomSDncAUqRWMqHIRE3TdMQR9FuKikA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 743e0e9c80de11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:39acd807-1be4-4647-90b5-bd5af1fda8b1,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:39acd807-1be4-4647-90b5-bd5af1fda8b1,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:1434aff7e56e8bb2da39c96e5d51f507,BulkI D:260716142035SE0J6FE1,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 743e0e9c80de11f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1687945130; Thu, 16 Jul 2026 14:20:34 +0800 From: liqiang To: linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, bvanassche@acm.org, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH 1/5] scsi: ufs: core: Validate string descriptors Date: Thu, 16 Jul 2026 14:19:51 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li Qiang The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer. Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space. The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer. Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread. Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading") Fixes: d794b499f948 ("scsi: ufs: core: fix incorrect buffer duplication in = ufshcd_read_string_desc()") Signed-off-by: Li Qiang --- drivers/ufs/core/ufshcd.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index d3044a3089b5..3541da5b6f4d 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -3865,7 +3865,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 d= esc_index, u8 **buf, enum u { struct uc_string_id *uc_str; u8 *str; - int ret; + int ret, uc_len; =20 if (!buf) return -EINVAL; @@ -3890,11 +3890,19 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8= desc_index, u8 **buf, enum u goto out; } =20 + uc_len =3D uc_str->len - QUERY_DESC_HDR_SIZE; + if (uc_len % sizeof(*uc_str->uc)) { + dev_err(hba->dev, "String Desc has an odd UTF-16 payload length\n"); + str =3D NULL; + ret =3D -EINVAL; + goto out; + } + if (fmt =3D=3D SD_ASCII_STD) { ssize_t ascii_len; int i; - /* remove header and divide by 2 to move from UTF16 to UTF8 */ - ascii_len =3D (uc_str->len - QUERY_DESC_HDR_SIZE) / 2 + 1; + /* Allow up to three UTF-8 bytes per UTF-16 code unit plus a NUL. */ + ascii_len =3D uc_len / sizeof(*uc_str->uc) * 3 + 1; str =3D kzalloc(ascii_len, GFP_KERNEL); if (!str) { ret =3D -ENOMEM; @@ -3906,7 +3914,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 d= esc_index, u8 **buf, enum u * we need to convert to utf-8 so it can be displayed */ ret =3D utf16s_to_utf8s(uc_str->uc, - uc_str->len - QUERY_DESC_HDR_SIZE, + uc_len / sizeof(*uc_str->uc), UTF16_BIG_ENDIAN, str, ascii_len - 1); =20 /* replace non-printable or non-ASCII characters with spaces */ @@ -3916,11 +3924,17 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8= desc_index, u8 **buf, enum u str[ret++] =3D '\0'; =20 } else { - str =3D kmemdup(uc_str->uc, uc_str->len, GFP_KERNEL); + /* + * Keep the bLength-sized raw output for the RPMB device ID ABI. + * The two bytes beyond the UTF-16 payload are explicitly zeroed + * instead of being read past the descriptor buffer. + */ + str =3D kzalloc(uc_str->len, GFP_KERNEL); if (!str) { ret =3D -ENOMEM; goto out; } + memcpy(str, uc_str->uc, uc_len); ret =3D uc_str->len; } out: --=20 2.43.0 From nobody Sat Jul 25 16:19:15 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E948C21CC44; Thu, 16 Jul 2026 06:20:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182841; cv=none; b=FE+wIg4sTFUJG7f7+5vvlwH0NgPq8jMkWZ+an1KwrPfrjzfTzrUO6/xaSCrAKA7xkcWxDKlcPSeopLT1j1zdUkuJU+kwVZYA5Y2x8zCd7gSYT4w/ADfqF2aoMdopIUDB0C76qjTjKs6DzUlZj+ug1Vm9+ocjQ7/jcYzheIHSDZs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182841; c=relaxed/simple; bh=qhzOcBK8pmD67n01Gg87xOaDGvMfm+nCRJN2A7xlYFk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nJPstn4uYNjeMDrYOEZW4MveGzZ7ikFmlZXZ/C5aQjXlOic1iZ5E2mN91sqPBQsU6SjNMAwagJcnuYPQDzDqNABbrTb6Uy3dkitI5d1Yn3G/LgUD+BIddtAj21yDoJDrwLMBsRuE1FCKmiVetIiOfEBcLagpYLF/VPMV6S91F/c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 74a73c1e80de11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:fb403757-7971-4c4d-a7bc-92557e8f0814,IP:15, URL:0,TC:0,Content:-25,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACT ION:release,TS:15 X-CID-INFO: VERSION:1.3.12,REQID:fb403757-7971-4c4d-a7bc-92557e8f0814,IP:15,UR L:0,TC:0,Content:-25,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:15 X-CID-META: VersionHash:e7bac3a,CLOUDID:71be0df4a289e05bef4e49303aaccbd8,BulkI D:2607161420353BTX94ED,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 74a73c1e80de11f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 549025416; Thu, 16 Jul 2026 14:20:35 +0800 From: liqiang To: linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, bvanassche@acm.org, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH 2/5] scsi: ufs: Fix NULL dereferences after tag lookup Date: Thu, 16 Jul 2026 14:19:52 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li Qiang ufshcd_tag_to_cmd() can return NULL when no command is associated with a tag. The MCQ cleanup and completion paths dereferenced the result before checking it. Move private-command and request lookups after the NULL checks. Also avoid dereferencing cqe while reporting an invalid tag because the single-doorbell completion path passes a NULL CQE. Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path") Signed-off-by: Li Qiang --- drivers/ufs/core/ufs-mcq.c | 6 ++++-- drivers/ufs/core/ufshcd.c | 7 ++++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c index 13b60a2d06db..15850b0658f9 100644 --- a/drivers/ufs/core/ufs-mcq.c +++ b/drivers/ufs/core/ufs-mcq.c @@ -555,8 +555,8 @@ static int ufshcd_mcq_sq_start(struct ufs_hba *hba, str= uct ufs_hw_queue *hwq) int ufshcd_mcq_sq_cleanup(struct ufs_hba *hba, int task_tag) { struct scsi_cmnd *cmd =3D ufshcd_tag_to_cmd(hba, task_tag); - struct ufshcd_lrb *lrbp =3D scsi_cmd_priv(cmd); - struct request *rq =3D scsi_cmd_to_rq(cmd); + struct ufshcd_lrb *lrbp; + struct request *rq; struct ufs_hw_queue *hwq; void __iomem *reg, *opr_sqd_base; u32 nexus, id, val; @@ -568,6 +568,8 @@ int ufshcd_mcq_sq_cleanup(struct ufs_hba *hba, int task= _tag) if (!cmd) return -EINVAL; =20 + lrbp =3D scsi_cmd_priv(cmd); + rq =3D scsi_cmd_to_rq(cmd); hwq =3D ufshcd_mcq_req_to_hwq(hba, rq); if (!hwq) return 0; diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 3541da5b6f4d..f2a5fa624e74 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -5857,13 +5857,14 @@ void ufshcd_compl_one_cqe(struct ufs_hba *hba, int = task_tag, struct cq_entry *cqe) { struct scsi_cmnd *cmd =3D ufshcd_tag_to_cmd(hba, task_tag); - struct ufshcd_lrb *lrbp =3D scsi_cmd_priv(cmd); + struct ufshcd_lrb *lrbp; enum utp_ocs ocs; =20 - if (WARN_ONCE(!cmd, "cqe->command_desc_base_addr =3D %#llx\n", - le64_to_cpu(cqe->command_desc_base_addr))) + if (WARN_ONCE(!cmd, "invalid completion tag %d, cqe->command_desc_base_ad= dr =3D %#llx\n", + task_tag, cqe ? le64_to_cpu(cqe->command_desc_base_addr) : 0ULL)) return; =20 + lrbp =3D scsi_cmd_priv(cmd); if (hba->monitor.enabled) { lrbp->compl_time_stamp =3D ktime_get(); lrbp->compl_time_stamp_local_clock =3D local_clock(); --=20 2.43.0 From nobody Sat Jul 25 16:19:15 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7456D23BD17; Thu, 16 Jul 2026 06:20:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182843; cv=none; b=mYvOR0vcJQpm6YyO1elOXXcOzdpR9OdEGp7BwicoDDV9MYPPL3ex5EPcPJy1HwR/GVmTgzI+en27nzai1RUVgLOlV0JmReSkh1nYsWjuDDBw5UWGplZig6s5D3MgSOgUUzUYtYz25QlWzlf1vhiKccaF9j/6YFjj5kgPzNH/UII= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182843; c=relaxed/simple; bh=6mQnSFefLQNiNQXior6B1LcT+cQDcZgH50BxCN/ZCRY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WVQC0HJS0+mIQU8vW0ts0GpIuWN0MV0yDM34ZACOFaOlssIxMpj0RV9aroKYDO5yhrk3KEbMsLYxN3/CN1I+RrWYSu0dWkJBgzNxVE/M4f+NcXrrvJppJxv3Au1PC9dZ+7d27c5APXjlNGE2CqmLrUt+NGwJO/ZZjGvmefDb2YE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 75100d2080de11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:9c43c007-149c-4859-bba3-7be5e4398362,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:9c43c007-149c-4859-bba3-7be5e4398362,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:207df51e48b0f015607a2499e5678cf8,BulkI D:260716142038CWCDLBZ9,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 75100d2080de11f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 2134191926; Thu, 16 Jul 2026 14:20:36 +0800 From: liqiang To: linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, bvanassche@acm.org, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH 3/5] scsi: ufs: core: Validate connected lane counts Date: Thu, 16 Jul 2026 14:19:53 +0800 Message-ID: <36211db67413ff6d352bb4e2073dc03704657283.1784182493.git.liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li Qiang The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated. Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Signed-off-by: Li Qiang --- drivers/ufs/core/ufshcd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index f2a5fa624e74..1319e1071025 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -4729,7 +4729,9 @@ static int ufshcd_get_max_pwr_mode(struct ufs_hba *hb= a) ufshcd_dme_get(hba, UIC_ARG_MIB(PA_CONNECTEDTXDATALANES), &pwr_info->lane_tx); =20 - if (!pwr_info->lane_rx || !pwr_info->lane_tx) { + if (!pwr_info->lane_rx || !pwr_info->lane_tx || + pwr_info->lane_rx > UFS_MAX_LANES || + pwr_info->lane_tx > UFS_MAX_LANES) { dev_err(hba->dev, "%s: invalid connected lanes value. rx=3D%d, tx=3D%d\n= ", __func__, pwr_info->lane_rx, --=20 2.43.0 From nobody Sat Jul 25 16:19:15 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E246223DFF; Thu, 16 Jul 2026 06:20:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182852; cv=none; b=aP+g68Q9nieeY3JbQKuBMCWEl7pABlb6qOqYe00XC9MRNDcb+5oJmnaeKRkbGVTFdCF9UNIOkcoRpmW3oEfaR96VyAMcqpQ6Tima35Vd9bjVEPYkhFzjWzn4kTKPLdNT/K2fPZIK8VK2VytA337MNICRq+71cklfuqmRVU9haNg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182852; c=relaxed/simple; bh=nxjbH6GXNrrixcAV67UNPKyYzhZEtJAsGOF4SkLanUE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pEgPzefOZRiT6eOzIhBuVXfMtUR3q2je8ggtsir4VtEUJc9vyw8j2EUfVRHLswLGgiSXCDfp/j9FWWMCuXFcmHajGUAc0IfARlIUSXGwZIGHrWhTWhI0aUMXkO/vce8VNhNZC4bkIsYsmvKk69g3hSp/jUXL6tC/EBqOX5p3pKI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 75785cf480de11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:fceac09e-a4d2-46c5-9503-74b842c45b45,IP:15, URL:0,TC:0,Content:-25,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACT ION:release,TS:15 X-CID-INFO: VERSION:1.3.12,REQID:fceac09e-a4d2-46c5-9503-74b842c45b45,IP:15,UR L:0,TC:0,Content:-25,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:15 X-CID-META: VersionHash:e7bac3a,CLOUDID:94cbe84b7af7721d1a676460f0bae25f,BulkI D:2607161420381J7P8O3U,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 75785cf480de11f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 861809527; Thu, 16 Jul 2026 14:20:36 +0800 From: liqiang To: linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, bvanassche@acm.org, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH 4/5] scsi: ufs: rpmb: Validate frame before parsing Date: Thu, 16 Jul 2026 14:19:54 +0800 Message-ID: <70412f5cb24714052127ada81a7aac0f9d86000e.1784182493.git.liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li Qiang The RPMB core only verifies that request and response buffers are nonempty. This callback reads req_resp at the end of the first request frame before validating the request length. Require a complete frame before that access. Use unaligned accessors because RPMB buffers are passed as u8 pointers and do not have an alignment guarantee. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS= devices") Signed-off-by: Li Qiang --- drivers/ufs/core/ufs-rpmb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c index ffad049872b9..53f66b274aca 100644 --- a/drivers/ufs/core/ufs-rpmb.c +++ b/drivers/ufs/core/ufs-rpmb.c @@ -69,7 +69,11 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 = *req, unsigned int req_l =20 hba =3D ufs_rpmb->hba; =20 - req_type =3D be16_to_cpu(frm_out->req_resp); + /* req_resp is at the end of an RPMB frame. */ + if (req_len < sizeof(*frm_out)) + return -EINVAL; + + req_type =3D get_unaligned_be16(&frm_out->req_resp); =20 switch (req_type) { case RPMB_PROGRAM_KEY: @@ -107,7 +111,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8= *req, unsigned int req_l struct rpmb_frame *frm_resp =3D (struct rpmb_frame *)resp; =20 memset(frm_resp, 0, sizeof(*frm_resp)); - frm_resp->req_resp =3D cpu_to_be16(RPMB_RESULT_READ); + put_unaligned_be16(RPMB_RESULT_READ, &frm_resp->req_resp); ret =3D ufs_sec_submit(hba, protocol_id, resp, resp_len, true); if (ret) { dev_err(dev, "Result read request failed with ret=3D%d\n", ret); --=20 2.43.0 From nobody Sat Jul 25 16:19:15 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA6B627A462; Thu, 16 Jul 2026 06:20:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182844; cv=none; b=B5GEO7yNIrAPsrX8qMskqIpS2RfCQaNybrQiwhXiAgZQYjmB5v8GZLxKqqSICz7qk99Fl/DBFewLBlFYr5P5b8/VPTv+ro5t919AN62aAkEYajAj8bQENVG2yi2FIHDiPZ/ggLAZFrZdPYUfFkMresoX93/xAg0NaLMNaKmvJIA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784182844; c=relaxed/simple; bh=fTbXHykDRL1s1iE8u0uBTPT2pqX6NFfnZQ0QVM4yQ+M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J31do6rsDjgSttFq6m9NqYHiae4DlbrfKz7dMy8BDjA6FcGBSudNDKYqKmxsoiwoYspUC5f4afg1Fniv2rtdnTWkT0MZkEuXh3PsINwWvt3E1MPwJhCDmQS+/BEx0NQXtXLn4HEisybc4RrPEHikHhTtV4eoEEC/BTSEVuTSmo4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: 75de372c80de11f1aa26b74ffac11d73-20260716 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:2f0fe61b-1c74-459f-bb7f-043dfc8691e8,IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:40 X-CID-INFO: VERSION:1.3.12,REQID:2f0fe61b-1c74-459f-bb7f-043dfc8691e8,IP:15,UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:40 X-CID-META: VersionHash:e7bac3a,CLOUDID:319b4cc1a541ea72a13c45e802bbb67e,BulkI D:260716142038WGCDI6IM,BulkQuantity:0,Recheck:0,SF:10|66|78|81|82|102|127| 865|898|908|914,TC:nil,Content:0|15|50,EDM:5,IP:-2,URL:0,File:nil,RT:nil,B ulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR :0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: 75de372c80de11f1aa26b74ffac11d73-20260716 X-User: liqiang01@kylinos.cn Received: from cvdaxia.localdomain [(116.128.244.171)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 1480870119; Thu, 16 Jul 2026 14:20:37 +0800 From: liqiang To: linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org, alim.akhtar@samsung.com, avri.altman@wdc.com, bvanassche@acm.org, James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, peter.wang@mediatek.com, beanhuo@micron.com, can.guo@oss.qualcomm.com, adrian.hunter@intel.com, tomas.winkler@intel.com Subject: [PATCH 5/5] scsi: ufs: debugfs: Reserve space for a string terminator Date: Thu, 16 Jul 2026 14:19:55 +0800 Message-ID: <123b934b63a0bb3f7aa016f640b992406acd4047.1784182493.git.liqiang01@kylinos.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li Qiang ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL. Fixes: 7340faae9474 ("scsi: ufs: core: Add debugfs attributes for triggerin= g the UFS EH") Signed-off-by: Li Qiang Reviewed-by: Bart Van Assche --- drivers/ufs/core/ufs-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ufs/core/ufs-debugfs.c b/drivers/ufs/core/ufs-debugfs.c index e3dd81d6fe82..be527209540d 100644 --- a/drivers/ufs/core/ufs-debugfs.c +++ b/drivers/ufs/core/ufs-debugfs.c @@ -165,7 +165,7 @@ static ssize_t ufs_saved_err_write(struct file *file, c= onst char __user *buf, char val_str[16] =3D { }; int val, ret; =20 - if (count > sizeof(val_str)) + if (count >=3D sizeof(val_str)) return -EINVAL; if (copy_from_user(val_str, buf, count)) return -EFAULT; --=20 2.43.0