linux-kernel - RE: [EXT] Re: [PATCH v3 1/1] scsi: ufs: fix LRB pointer incorrect initialization issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BN7PR08MB5684F9667DE1CD05D0D01EE6DBFF0@BN7PR08MB5684.namprd08.prod.outlook.com>
Date:   Tue, 10 Mar 2020 07:53:09 +0000
From:   "Bean Huo (beanhuo)" <beanhuo@...ron.com>
To:     Bart Van Assche <bvanassche@....org>,
        "huobean@...il.com" <huobean@...il.com>,
        "alim.akhtar@...sung.com" <alim.akhtar@...sung.com>,
        "avri.altman@....com" <avri.altman@....com>,
        "asutoshd@...eaurora.org" <asutoshd@...eaurora.org>,
        "jejb@...ux.ibm.com" <jejb@...ux.ibm.com>,
        "martin.petersen@...cle.com" <martin.petersen@...cle.com>,
        "stanley.chu@...iatek.com" <stanley.chu@...iatek.com>,
        "tomas.winkler@...el.com" <tomas.winkler@...el.com>,
        "cang@...eaurora.org" <cang@...eaurora.org>
CC:     "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [EXT] Re: [PATCH v3 1/1] scsi: ufs: fix LRB pointer incorrect
 initialization issue

Hi, Bart 

> Subject: [EXT] Re: [PATCH v3 1/1] scsi: ufs: fix LRB pointer incorrect initialization
> issue
> 
> On 2020-03-09 09:10, huobean@...il.com wrote:
> > @@ -4834,6 +4829,7 @@ static void __ufshcd_transfer_req_compl(struct
> ufs_hba *hba,
> >  			continue;
> >  		cmd = blk_mq_rq_to_pdu(req);
> >  		lrbp = scsi_cmd_priv(cmd);
> > +		ufshcd_init_lrb(hba, lrbp, index);
> >  		if (ufshcd_is_scsi(req)) {
> >  			ufshcd_add_command_trace(hba, req, "complete");
> >  			result = ufshcd_transfer_rsp_status(hba, lrbp);
> 
> This ufshcd_init_lrb() call looks incorrect to me. I think that
> ufshcd_init_lrb() should only be called before a request is submitted to the UFS
> controller and also that ufshcd_init_lrb() should not be called from the
> completion path.
> 

__ufshcd_transfer_req_compl()
	ufshcd_transfer_rsp_status()  will access lrbp->ucd_rsp_ptr.
Without calling ufshcd_init_lrb() here, there will be an error.

//Bean

 
> Thanks,
> 
> Bart.