mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 15:18:19 +00:00
scsi: ufs: bsg: Remove unnecessary length checkup
Remove checks on job->request_len and job->reply_len because msgcode checks in a subseqent commit will rule out malicious requests. Signed-off-by: Bean Huo <beanhuo@micron.com> Acked-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
3f5145a615
commit
64d4864714
1 changed files with 0 additions and 21 deletions
|
@ -30,21 +30,6 @@ static int ufs_bsg_get_query_desc_size(struct ufs_hba *hba, int *desc_len,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int ufs_bsg_verify_query_size(struct ufs_hba *hba,
|
|
||||||
unsigned int request_len,
|
|
||||||
unsigned int reply_len)
|
|
||||||
{
|
|
||||||
int min_req_len = sizeof(struct ufs_bsg_request);
|
|
||||||
int min_rsp_len = sizeof(struct ufs_bsg_reply);
|
|
||||||
|
|
||||||
if (min_req_len > request_len || min_rsp_len > reply_len) {
|
|
||||||
dev_err(hba->dev, "not enough space assigned\n");
|
|
||||||
return -EINVAL;
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int ufs_bsg_alloc_desc_buffer(struct ufs_hba *hba, struct bsg_job *job,
|
static int ufs_bsg_alloc_desc_buffer(struct ufs_hba *hba, struct bsg_job *job,
|
||||||
uint8_t **desc_buff, int *desc_len,
|
uint8_t **desc_buff, int *desc_len,
|
||||||
enum query_opcode desc_op)
|
enum query_opcode desc_op)
|
||||||
|
@ -88,8 +73,6 @@ static int ufs_bsg_request(struct bsg_job *job)
|
||||||
struct ufs_bsg_request *bsg_request = job->request;
|
struct ufs_bsg_request *bsg_request = job->request;
|
||||||
struct ufs_bsg_reply *bsg_reply = job->reply;
|
struct ufs_bsg_reply *bsg_reply = job->reply;
|
||||||
struct ufs_hba *hba = shost_priv(dev_to_shost(job->dev->parent));
|
struct ufs_hba *hba = shost_priv(dev_to_shost(job->dev->parent));
|
||||||
unsigned int req_len = job->request_len;
|
|
||||||
unsigned int reply_len = job->reply_len;
|
|
||||||
struct uic_command uc = {};
|
struct uic_command uc = {};
|
||||||
int msgcode;
|
int msgcode;
|
||||||
uint8_t *desc_buff = NULL;
|
uint8_t *desc_buff = NULL;
|
||||||
|
@ -97,10 +80,6 @@ static int ufs_bsg_request(struct bsg_job *job)
|
||||||
enum query_opcode desc_op = UPIU_QUERY_OPCODE_NOP;
|
enum query_opcode desc_op = UPIU_QUERY_OPCODE_NOP;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
ret = ufs_bsg_verify_query_size(hba, req_len, reply_len);
|
|
||||||
if (ret)
|
|
||||||
goto out;
|
|
||||||
|
|
||||||
bsg_reply->reply_payload_rcv_len = 0;
|
bsg_reply->reply_payload_rcv_len = 0;
|
||||||
|
|
||||||
ufshcd_rpm_get_sync(hba);
|
ufshcd_rpm_get_sync(hba);
|
||||||
|
|
Loading…
Reference in a new issue