Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3281c7b7 authored by Yaniv Gardi's avatar Yaniv Gardi Committed by David Keitel
Browse files

scsi: ufs: fix bugs related to null pointer access and array size 



In this change there are a few fixes of possible NULL pointer access
and possible access to index that exceeds array boundaries.

Change-Id: I4a2dbc417d53931e012925978cd52e3397356ec2
Signed-off-by: default avatarYaniv Gardi <ygardi@codeaurora.org>
[subhashj@codeaurora.org: resolved trivial merge conflicts]
Signed-off-by: default avatarSubhash Jadavani <subhashj@codeaurora.org>
parent 50d8c771

drivers/scsi/ufs/ufs.h

+2 −1
Original line number Diff line number Diff line
@@ -47,6 +47,7 @@ 
#define QUERY_DESC_HDR_SIZE       2

#define QUERY_OSF_SIZE            (GENERAL_UPIU_REQUEST_SIZE - \

					(sizeof(struct utp_upiu_header)))

#define RESPONSE_UPIU_SENSE_DATA_LENGTH	18



#define UPIU_HEADER_DWORD(byte3, byte2, byte1, byte0)\

			cpu_to_be32((byte3 << 24) | (byte2 << 16) |\
@@ -383,7 +384,7 @@ struct utp_cmd_rsp { 
	__be32 residual_transfer_count;

	__be32 reserved[4];

	__be16 sense_data_len;

	u8 sense_data[18];

	u8 sense_data[RESPONSE_UPIU_SENSE_DATA_LENGTH];

};



/**

drivers/scsi/ufs/ufshcd.c

+18 −5
Original line number Diff line number Diff line
@@ -1085,10 +1085,14 @@ static inline void ufshcd_copy_sense_data(struct ufshcd_lrb *lrbp) 
	int len;

	if (lrbp->sense_buffer &&

	    ufshcd_get_rsp_upiu_data_seg_len(lrbp->ucd_rsp_ptr)) {

		int len_to_copy;



		len = be16_to_cpu(lrbp->ucd_rsp_ptr->sr.sense_data_len);

		len_to_copy = min_t(int, RESPONSE_UPIU_SENSE_DATA_LENGTH, len);



		memcpy(lrbp->sense_buffer,

			lrbp->ucd_rsp_ptr->sr.sense_data,

			min_t(int, len, SCSI_SENSE_BUFFERSIZE));

			min_t(int, len_to_copy, SCSI_SENSE_BUFFERSIZE));

	}

}
@@ -4856,7 +4860,7 @@ static int ufshcd_get_device_ref_clk(struct ufs_hba *hba) 
	err = ufshcd_query_attr_retry(hba, UPIU_QUERY_OPCODE_READ_ATTR,

			QUERY_ATTR_IDN_REF_CLK_FREQ, 0, 0, &val);



	if (err || val >= sizeof(arr) || val < 0) {

	if (err || val >= ARRAY_SIZE(arr) || val < 0) {

		dev_err(hba->dev, "%s: err = %d, val = %d",

			 __func__, err, val);

		goto out;
@@ -6129,7 +6133,10 @@ int ufshcd_system_resume(struct ufs_hba *hba) 
	int ret = 0;

	ktime_t start = ktime_get();



	if (!hba || !hba->is_powered || pm_runtime_suspended(hba->dev))

	if (!hba)

		return -EINVAL;



	if (!hba->is_powered || pm_runtime_suspended(hba->dev))

		/*

		 * Let the runtime resume take care of resuming

		 * if runtime suspended.
@@ -6159,7 +6166,10 @@ int ufshcd_runtime_suspend(struct ufs_hba *hba) 
	int ret = 0;

	ktime_t start = ktime_get();



	if (!hba || !hba->is_powered)

	if (!hba)

		return -EINVAL;



	if (!hba->is_powered)

		goto out;

	else

		ret = ufshcd_suspend(hba, UFS_RUNTIME_PM);
@@ -6199,7 +6209,10 @@ int ufshcd_runtime_resume(struct ufs_hba *hba) 
	int ret = 0;

	ktime_t start = ktime_get();



	if (!hba || !hba->is_powered)

	if (!hba)

		return -EINVAL;



	if (!hba->is_powered)

		goto out;

	else

		ret = ufshcd_resume(hba, UFS_RUNTIME_PM);