From patchwork Sun Nov 20 21:59:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bean Huo X-Patchwork-Id: 628215 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A49AEC433FE for ; Sun, 20 Nov 2022 22:03:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229751AbiKTWDG (ORCPT ); Sun, 20 Nov 2022 17:03:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53274 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229746AbiKTWCu (ORCPT ); Sun, 20 Nov 2022 17:02:50 -0500 Received: from mo4-p05-ob.smtp.rzone.de (mo4-p05-ob.smtp.rzone.de [85.215.255.133]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7021B7C6; Sun, 20 Nov 2022 14:02:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1668981575; s=strato-dkim-0002; d=iokpp.de; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Cc:Date: From:Subject:Sender; bh=4or19oni+bDvVyKbujd8XZcrwPUcGVDhQoJCH3MirPs=; b=Qy9uG93yK0M5bFXdFHTVjptr9dd8YjRu0ITiYylGrRD61FHZ4IeRwkJjGCsDAUylg8 5RM+qYi/BVwycubwZcyc4drLITA4FKKUvKBFZ7M4CltqL+dvVilO2N6F/Jm8hfWmQX9v T1K0ES1qQUoccI5Tm+5FmlmqrnyB1EDJ0pHodS6U4OQBsjv2Lfr9NvX6REcoXHclEGBa mwmE1hi6hSnQ6OmkDEknscTp8ziXjR0jotRlOmlZ0qwqwcm47XJyOYSj9HVimhbHvgQ4 uo/6agMAM1dJWZrCsrLLmzGMMvl90mfajqtu98THj1a0sRxG8Jc0Z7CQO16Boayctxq5 rJAA== Authentication-Results: strato.com; dkim=none X-RZG-AUTH: ":LmkFe0i9dN8c2t4QQyGBB/NDXvjDB6pBSedrgBzPc9DUyubU4DD1QLj68UeUr1+U1RvWtIfZ/7Q8ZGqEBlwxF4QH61wYa9UK/y81Dg==" X-RZG-CLASS-ID: mo05 Received: from blinux.speedport.ip by smtp.strato.de (RZmta 48.2.1 AUTH) with ESMTPSA id z9cfbfyAKLxZWa3 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256 bits)) (Client did not present a certificate); Sun, 20 Nov 2022 22:59:35 +0100 (CET) From: Bean Huo To: alim.akhtar@samsung.com, avri.altman@wdc.com, jejb@linux.ibm.com, martin.petersen@oracle.com, stanley.chu@mediatek.com, beanhuo@micron.com, bvanassche@acm.org, tomas.winkler@intel.com, daejun7.park@samsung.com, quic_cang@quicinc.com, quic_nguyenb@quicinc.com, quic_xiaosenh@quicinc.com, quic_richardp@quicinc.com, quic_asutoshd@quicinc.com, hare@suse.de Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/6] ufs: ufs_bsg: Remove unnecessary length checkup Date: Sun, 20 Nov 2022 22:59:21 +0100 Message-Id: <20221120215927.104580-2-beanhuo@micron.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221120215927.104580-1-beanhuo@micron.com> References: <20221120215927.104580-1-beanhuo@micron.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org Remove checks on job->request_len and job->reply_len because The following msgcode checks will rule out malicious requests. Signed-off-by: Bean Huo --- drivers/ufs/core/ufs_bsg.c | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index b99e3f3dc4ef..9ac8204f1ee6 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -30,21 +30,6 @@ static int ufs_bsg_get_query_desc_size(struct ufs_hba *hba, int *desc_len, return 0; } -static int ufs_bsg_verify_query_size(struct ufs_hba *hba, - unsigned int request_len, - unsigned int reply_len) -{ - int min_req_len = sizeof(struct ufs_bsg_request); - int min_rsp_len = sizeof(struct ufs_bsg_reply); - - if (min_req_len > request_len || min_rsp_len > reply_len) { - dev_err(hba->dev, "not enough space assigned\n"); - return -EINVAL; - } - - return 0; -} - static int ufs_bsg_alloc_desc_buffer(struct ufs_hba *hba, struct bsg_job *job, uint8_t **desc_buff, int *desc_len, enum query_opcode desc_op) @@ -88,8 +73,6 @@ static int ufs_bsg_request(struct bsg_job *job) struct ufs_bsg_request *bsg_request = job->request; struct ufs_bsg_reply *bsg_reply = job->reply; struct ufs_hba *hba = shost_priv(dev_to_shost(job->dev->parent)); - unsigned int req_len = job->request_len; - unsigned int reply_len = job->reply_len; struct uic_command uc = {}; int msgcode; uint8_t *desc_buff = NULL; @@ -97,10 +80,6 @@ static int ufs_bsg_request(struct bsg_job *job) enum query_opcode desc_op = UPIU_QUERY_OPCODE_NOP; int ret; - ret = ufs_bsg_verify_query_size(hba, req_len, reply_len); - if (ret) - goto out; - bsg_reply->reply_payload_rcv_len = 0; ufshcd_rpm_get_sync(hba); From patchwork Sun Nov 20 21:59:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bean Huo X-Patchwork-Id: 628216 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5ABFC433FE for ; Sun, 20 Nov 2022 22:02:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229767AbiKTWCw (ORCPT ); Sun, 20 Nov 2022 17:02:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229480AbiKTWCt (ORCPT ); Sun, 20 Nov 2022 17:02:49 -0500 X-Greylist: delayed 175 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Sun, 20 Nov 2022 14:02:40 PST Received: from mo4-p05-ob.smtp.rzone.de (mo4-p05-ob.smtp.rzone.de [85.215.255.134]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C9567656; Sun, 20 Nov 2022 14:02:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1668981575; s=strato-dkim-0002; d=iokpp.de; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Cc:Date: From:Subject:Sender; bh=uNJzfpTqXlhAci+Y94MUZIfPpwoY6uUa/PqRLAciO9M=; b=jNwgajCP9gvAPWh2waX+3rh+WVW4B7EGbezyKo/Vlib5k13t03OwUwUCRQg9XBfI9/ a3sMtXbkeH8xXKuINMNcJv+hIzZfeEwRJK35D5AKGaddBbUv98L/t1zl9O7OKpDe3u8D wqVahmCtr8Y7oRiKadRvBKCmLyjYy3qOU0XqtMVle5FDUtmJeqv9tfZ1Od/sevGqguld lt6NOYBG1/BRU8z5bXOjJVo2hw91n/WG/nYx3SJFHcL5YOChHjo9xQr6gAedjnG1rZwR 6JJrC8epgL+wri44j+QhpHD4RhCzG3e9LpVINNIEPL4dGk4Of1KQ92xz3vTvI+VioV3f GzaA== Authentication-Results: strato.com; dkim=none X-RZG-AUTH: ":LmkFe0i9dN8c2t4QQyGBB/NDXvjDB6pBSedrgBzPc9DUyubU4DD1QLj68UeUr1+U1RvWtIfZ/7Q8ZGqEBlwxF4QH61wYa9UK/y81Dg==" X-RZG-CLASS-ID: mo05 Received: from blinux.speedport.ip by smtp.strato.de (RZmta 48.2.1 AUTH) with ESMTPSA id z9cfbfyAKLxZWa4 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256 bits)) (Client did not present a certificate); Sun, 20 Nov 2022 22:59:35 +0100 (CET) From: Bean Huo To: alim.akhtar@samsung.com, avri.altman@wdc.com, jejb@linux.ibm.com, martin.petersen@oracle.com, stanley.chu@mediatek.com, beanhuo@micron.com, bvanassche@acm.org, tomas.winkler@intel.com, daejun7.park@samsung.com, quic_cang@quicinc.com, quic_nguyenb@quicinc.com, quic_xiaosenh@quicinc.com, quic_richardp@quicinc.com, quic_asutoshd@quicinc.com, hare@suse.de Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/6] ufs: ufs_bsg: Cleanup ufs_bsg_request Date: Sun, 20 Nov 2022 22:59:22 +0100 Message-Id: <20221120215927.104580-3-beanhuo@micron.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221120215927.104580-1-beanhuo@micron.com> References: <20221120215927.104580-1-beanhuo@micron.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org Move sg_copy_from_buffer() below its associated case statement. Signed-off-by: Bean Huo --- drivers/ufs/core/ufs_bsg.c | 27 ++++++++------------------- 1 file changed, 8 insertions(+), 19 deletions(-) diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 9ac8204f1ee6..850a0d798f63 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -90,11 +90,8 @@ static int ufs_bsg_request(struct bsg_job *job) desc_op = bsg_request->upiu_req.qr.opcode; ret = ufs_bsg_alloc_desc_buffer(hba, job, &desc_buff, &desc_len, desc_op); - if (ret) { - ufshcd_rpm_put_sync(hba); + if (ret) goto out; - } - fallthrough; case UPIU_TRANSACTION_NOP_OUT: case UPIU_TRANSACTION_TASK_REQ: @@ -102,9 +99,12 @@ static int ufs_bsg_request(struct bsg_job *job) &bsg_reply->upiu_rsp, msgcode, desc_buff, &desc_len, desc_op); if (ret) - dev_err(hba->dev, - "exe raw upiu: error code %d\n", ret); - + dev_err(hba->dev, "exe raw upiu: error code %d\n", ret); + else if (desc_op == UPIU_QUERY_OPCODE_READ_DESC && desc_len) + bsg_reply->reply_payload_rcv_len = + sg_copy_from_buffer(job->request_payload.sg_list, + job->request_payload.sg_cnt, + desc_buff, desc_len); break; case UPIU_TRANSACTION_UIC_CMD: memcpy(&uc, &bsg_request->upiu_req.uc, UIC_CMD_SIZE); @@ -123,20 +123,9 @@ static int ufs_bsg_request(struct bsg_job *job) break; } +out: ufshcd_rpm_put_sync(hba); - - if (!desc_buff) - goto out; - - if (desc_op == UPIU_QUERY_OPCODE_READ_DESC && desc_len) - bsg_reply->reply_payload_rcv_len = - sg_copy_from_buffer(job->request_payload.sg_list, - job->request_payload.sg_cnt, - desc_buff, desc_len); - kfree(desc_buff); - -out: bsg_reply->result = ret; job->reply_len = sizeof(struct ufs_bsg_reply); /* complete the job here only if no error */