linux-kernel - RE: [PATCH v2] ufs: core: bsg: Fix memory crash in case arpmb command failed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <PH0PR16MB4245F16B2732AF3078DB1DC6F4FA2@PH0PR16MB4245.namprd16.prod.outlook.com>
Date: Tue, 18 Feb 2025 15:12:47 +0000
From: Arthur Simchaev <Arthur.Simchaev@...disk.com>
To: Bean Huo <huobean@...il.com>, "martin.petersen@...cle.com"
	<martin.petersen@...cle.com>
CC: Avri Altman <Avri.Altman@...disk.com>, Avi Shchislowski
	<Avi.Shchislowski@...disk.com>, "beanhuo@...ron.com" <beanhuo@...ron.com>,
	"linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"bvanassche@....org" <bvanassche@....org>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: RE: [PATCH v2] ufs: core: bsg: Fix memory crash in case arpmb command
 failed

> 
> very strange,  I didn't reproduce this issue with the same command, but I saw
> the problem job->result was not updated.
> 
> 
> it should not be job->reply_len issue, since we initiated the max_response_len,
> then:
> 
> int len = min(hdr->max_response_len, job->reply_len);
> 
> 
> could you check if this works:
> 
> 
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 8d4ad0a3f2cf..943382b142ca 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -195,9 +195,9 @@ static int ufs_bsg_request(struct bsg_job *job)
>         kfree(buff);
>         bsg_reply->result = ret;
>         job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) :
> sizeof(struct ufs_rpmb_reply);
> -       /* complete the job here only if no error */
> -       if (ret == 0)
> -               bsg_job_done(job, ret, bsg_reply-
> >reply_payload_rcv_len);
> +
> +       /* complete the job here */
> +       bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
> 
>         return ret;
>  }
> 
> 
> Kind regards,
> Bean

Also, this change fix the crash, but ufs-utils didn't get the error message
With my patch the tool got an error value of -22 (-EINVAL), as expected

Regards
Arthur