releases/4.14.130/scsi-ufs-check-that-space-was-properly-alloced-in-co.patch

   1 From 37eccfd7b292572f2571fb941e704cd1373ce9a6 Mon Sep 17 00:00:00 2001
   2 From: Avri Altman <avri.altman@wdc.com>
   3 Date: Tue, 21 May 2019 11:24:22 +0300
   4 Subject: scsi: ufs: Check that space was properly alloced in
   5  copy_query_response
   6
   7 [ Upstream commit 1c90836f70f9a8ef7b7ad9e1fdd8961903e6ced6 ]
   8
   9 struct ufs_dev_cmd is the main container that supports device management
  10 commands. In the case of a read descriptor request, we assume that the
  11 proper space was allocated in dev_cmd to hold the returning descriptor.
  12
  13 This is no longer true, as there are flows that doesn't use dev_cmd for
  14 device management requests, and was wrong in the first place.
  15
  16 Fixes: d44a5f98bb49 (ufs: query descriptor API)
  17 Signed-off-by: Avri Altman <avri.altman@wdc.com>
  18 Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
  19 Acked-by: Bean Huo <beanhuo@micron.com>
  20 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  21 Signed-off-by: Sasha Levin <sashal@kernel.org>
  22 ---
  23  drivers/scsi/ufs/ufshcd.c | 3 ++-
  24  1 file changed, 2 insertions(+), 1 deletion(-)
  25
  26 diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
  27 index d8f0a1ccd9b1..60c9184bad3b 100644
  28 --- a/drivers/scsi/ufs/ufshcd.c
  29 +++ b/drivers/scsi/ufs/ufshcd.c
  30 @@ -1788,7 +1788,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
  31         memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE);
  32
  33         /* Get the descriptor */
  34 -       if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
  35 +       if (hba->dev_cmd.query.descriptor &&
  36 +           lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
  37                 u8 *descp = (u8 *)lrbp->ucd_rsp_ptr +
  38                                 GENERAL_UPIU_REQUEST_SIZE;
  39                 u16 resp_len;
  40 --
  41 2.20.1
  42