linux-kernel - RE: [PATCH v1 1/1] scsi: ufs: core: correct utp_transfer_cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <DM6PR04MB65750D13F7417242DB51E98CFC6A9@DM6PR04MB6575.namprd04.prod.outlook.com>
Date:   Thu, 27 Apr 2023 09:57:27 +0000
From:   Avri Altman <Avri.Altman@....com>
To:     "Bao D. Nguyen" <quic_nguyenb@...cinc.com>,
        "quic_asutoshd@...cinc.com" <quic_asutoshd@...cinc.com>,
        "quic_cang@...cinc.com" <quic_cang@...cinc.com>,
        "bvanassche@....org" <bvanassche@....org>,
        "mani@...nel.org" <mani@...nel.org>,
        "stanley.chu@...iatek.com" <stanley.chu@...iatek.com>,
        "adrian.hunter@...el.com" <adrian.hunter@...el.com>,
        "beanhuo@...ron.com" <beanhuo@...ron.com>,
        "martin.petersen@...cle.com" <martin.petersen@...cle.com>
CC:     "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
        Alim Akhtar <alim.akhtar@...sung.com>,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        Alice Chao <alice.chao@...iatek.com>,
        open list <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v1 1/1] scsi: ufs: core: correct utp_transfer_cmd_desc
 size

> When allocating memory for the UTP Command Descriptor
> hba->ucdl_base_addr in ufshcd_memory_alloc(), the macro
> sizeof_utp_transfer_cmd_desc() is used to calculate the size of the memory
> allocation. This macro includes the prd_table as part of the UTP Command
> Descriptor memory. However, when freeing this memory in the
> ufshcd_release_sdb_queue(), the sizeof(struct utp_transfer_cmd_desc) is
> used, and it does not include the prd_table size for the memory to be freed.
> This results in a mismatch of memory size allocated/freed.
> 
> Similarly, the ufshcd_mcq_get_tag() incorrectly uses the sizeof(struct
> utp_transfer_cmd_desc) to find the tag number.
> This results in failing to probe.
> 
> Signed-off-by: Bao D. Nguyen <quic_nguyenb@...cinc.com>
Looks like this fix is suggested here as well -
https://www.spinics.net/lists/linux-scsi/msg184092.html

Thanks,
Avri

> ---
>  drivers/ufs/core/ufs-mcq.c | 2 +-
>  drivers/ufs/core/ufshcd.c  | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c index
> 202ff71..b7c5f39 100644
> --- a/drivers/ufs/core/ufs-mcq.c
> +++ b/drivers/ufs/core/ufs-mcq.c
> @@ -265,7 +265,7 @@ static int ufshcd_mcq_get_tag(struct ufs_hba *hba,
>         addr = (le64_to_cpu(cqe->command_desc_base_addr) & CQE_UCD_BA) -
>                 hba->ucdl_dma_addr;
> 
> -       return div_u64(addr, sizeof(struct utp_transfer_cmd_desc));
> +       return div_u64(addr, sizeof_utp_transfer_cmd_desc(hba));
>  }
> 
>  static void ufshcd_mcq_process_cqe(struct ufs_hba *hba, diff --git
> a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index
> 9434328..b009e55 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -8444,7 +8444,7 @@ static void ufshcd_release_sdb_queue(struct
> ufs_hba *hba, int nutrs)  {
>         size_t ucdl_size, utrdl_size;
> 
> -       ucdl_size = sizeof(struct utp_transfer_cmd_desc) * nutrs;
> +       ucdl_size = sizeof_utp_transfer_cmd_desc(hba) * nutrs;
>         dmam_free_coherent(hba->dev, ucdl_size, hba->ucdl_base_addr,
>                            hba->ucdl_dma_addr);
> 
> --
> 2.7.4