mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 02:09:42 +00:00
scsi: ufs: fix failure to read the string descriptor
While reading variable size descriptors (like string descriptor), some UFS devices may report the "LENGTH" (field in "Transaction Specific fields" of Query Response UPIU) same as what was requested in Query Request UPIU instead of reporting the actual size of the variable size descriptor. Although it's safe to ignore the "LENGTH" field for variable size descriptors as we can always derive the length of the descriptor from the descriptor header fields. Hence this change impose the length match check only for fixed size descriptors (for which we always request the correct size as part of Query Request UPIU). Reviewed-by: Venkat Gopalakrishnan <venkatg@codeaurora.org> Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
24d6243204
commit
bde44bb665
1 changed files with 31 additions and 9 deletions
|
@ -2108,19 +2108,41 @@ static int ufshcd_read_desc_param(struct ufs_hba *hba,
|
|||
desc_id, desc_index, 0, desc_buf,
|
||||
&buff_len);
|
||||
|
||||
if (ret || (buff_len < ufs_query_desc_max_size[desc_id]) ||
|
||||
(desc_buf[QUERY_DESC_LENGTH_OFFSET] !=
|
||||
ufs_query_desc_max_size[desc_id])
|
||||
|| (desc_buf[QUERY_DESC_DESC_TYPE_OFFSET] != desc_id)) {
|
||||
dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, param_offset %d, buff_len %d ,index %d, ret %d",
|
||||
__func__, desc_id, param_offset, buff_len,
|
||||
desc_index, ret);
|
||||
if (!ret)
|
||||
ret = -EINVAL;
|
||||
if (ret) {
|
||||
dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d",
|
||||
__func__, desc_id, desc_index, param_offset, ret);
|
||||
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Sanity check */
|
||||
if (desc_buf[QUERY_DESC_DESC_TYPE_OFFSET] != desc_id) {
|
||||
dev_err(hba->dev, "%s: invalid desc_id %d in descriptor header",
|
||||
__func__, desc_buf[QUERY_DESC_DESC_TYPE_OFFSET]);
|
||||
ret = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
/*
|
||||
* While reading variable size descriptors (like string descriptor),
|
||||
* some UFS devices may report the "LENGTH" (field in "Transaction
|
||||
* Specific fields" of Query Response UPIU) same as what was requested
|
||||
* in Query Request UPIU instead of reporting the actual size of the
|
||||
* variable size descriptor.
|
||||
* Although it's safe to ignore the "LENGTH" field for variable size
|
||||
* descriptors as we can always derive the length of the descriptor from
|
||||
* the descriptor header fields. Hence this change impose the length
|
||||
* match check only for fixed size descriptors (for which we always
|
||||
* request the correct size as part of Query Request UPIU).
|
||||
*/
|
||||
if ((desc_id != QUERY_DESC_IDN_STRING) &&
|
||||
(buff_len != desc_buf[QUERY_DESC_LENGTH_OFFSET])) {
|
||||
dev_err(hba->dev, "%s: desc_buf length mismatch: buff_len %d, buff_len(desc_header) %d",
|
||||
__func__, buff_len, desc_buf[QUERY_DESC_LENGTH_OFFSET]);
|
||||
ret = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (is_kmalloc)
|
||||
memcpy(param_read_buf, &desc_buf[param_offset], param_size);
|
||||
out:
|
||||
|
|
Loading…
Reference in a new issue