mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
scsi: ufs: core: scsi_get_lba() error fix
When ufs initializes without scmd->device->sector_size set, scsi_get_lba() will get a wrong shift number and trigger an ubsan error. The shift exponent 4294967286 is too large for the 64-bit type 'sector_t' (aka 'unsigned long long'). Call scsi_get_lba() only when opcode is READ_10/WRITE_10/UNMAP. Link: https://lore.kernel.org/r/20220307111752.10465-1-peter.wang@mediatek.com Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
296559d41e
commit
2bd3b6b759
1 changed files with 3 additions and 2 deletions
|
@ -365,7 +365,7 @@ static void ufshcd_add_uic_command_trace(struct ufs_hba *hba,
|
|||
static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
|
||||
enum ufs_trace_str_t str_t)
|
||||
{
|
||||
u64 lba;
|
||||
u64 lba = 0;
|
||||
u8 opcode = 0, group_id = 0;
|
||||
u32 intr, doorbell;
|
||||
struct ufshcd_lrb *lrbp = &hba->lrb[tag];
|
||||
|
@ -382,7 +382,6 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
|
|||
return;
|
||||
|
||||
opcode = cmd->cmnd[0];
|
||||
lba = scsi_get_lba(cmd);
|
||||
|
||||
if (opcode == READ_10 || opcode == WRITE_10) {
|
||||
/*
|
||||
|
@ -390,6 +389,7 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
|
|||
*/
|
||||
transfer_len =
|
||||
be32_to_cpu(lrbp->ucd_req_ptr->sc.exp_data_transfer_len);
|
||||
lba = scsi_get_lba(cmd);
|
||||
if (opcode == WRITE_10)
|
||||
group_id = lrbp->cmd->cmnd[6];
|
||||
} else if (opcode == UNMAP) {
|
||||
|
@ -397,6 +397,7 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
|
|||
* The number of Bytes to be unmapped beginning with the lba.
|
||||
*/
|
||||
transfer_len = blk_rq_bytes(rq);
|
||||
lba = scsi_get_lba(cmd);
|
||||
}
|
||||
|
||||
intr = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
|
||||
|
|
Loading…
Reference in a new issue