linux-kernel - Re: [PATCH] scsi: ufs: core: Fix RPMB region size detection for UFS 2.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8149b8cb5a7b36a1543ca05666f33a6373674e0e.camel@gmail.com>
Date: Thu, 29 Jan 2026 17:53:41 +0100
From: Bean Huo <huobean@...il.com>
To: Alexey Charkov <alchark@...pper.net>, Alim Akhtar
 <alim.akhtar@...sung.com>,  Avri Altman <avri.altman@....com>, Bart Van
 Assche <bvanassche@....org>, "James E.J. Bottomley"
 <James.Bottomley@...senPartnership.com>, "Martin K. Petersen"
 <martin.petersen@...cle.com>, Bean Huo <beanhuo@...ron.com>, Can Guo
 <can.guo@....qualcomm.com>
Cc: linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org, 
	stable@...r.kernel.org
Subject: Re: [PATCH] scsi: ufs: core: Fix RPMB region size detection for UFS
 2.2

On Thu, 2026-01-29 at 11:38 +0400, Alexey Charkov wrote:
> +                       hba->dev_info.rpmb_region_size[0] =
> +                               get_unaligned_be64(desc_buf
> +                                       +
> RPMB_UNIT_DESC_PARAM_LOGICAL_BLK_COUNT)
> +                               <<
> desc_buf[RPMB_UNIT_DESC_PARAM_LOGICAL_BLK_SIZE]
> +                               >> 17; /* convert to 128 kBytes units */
> +               }
>         }

Hi Alexey, 

thanks for your fix, I didn't notice there is UFS 2.x on the market which will
use UFS OP-TEE RPMB framework.


here is potential u8 Overflow, since for the UFS3.x+, it is u8 in unit
descriptor, but                                                                
                                                                                                        

The calculation can overflow for larger RPMB regions (>32MB):                  
  - A u8 can only represent up to 255 × 128KB = ~32MB                          
  - The shift result is assigned directly without bounds checking


Kind regards,
Bean