Can, > Since WB feature has been added, WB related sysfs entries can be accessed > even when an UFS device does not support WB feature. In that case, the > descriptors which are not supported by the UFS device may be wrongly reported > when they are accessed from their corrsponding sysfs entries. > Fix it by adding a sanity check of parameter offset against the actual > decriptor > length. > > Signed-off-by: Can Guo <[email protected]> > > diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index > a2ebcc8..8861ad6 100644 > --- a/drivers/scsi/ufs/ufshcd.c > +++ b/drivers/scsi/ufs/ufshcd.c > @@ -3184,13 +3184,19 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, > /* Get the length of descriptor */ > ufshcd_map_desc_id_to_length(hba, desc_id, &buff_len); > if (!buff_len) { > - dev_err(hba->dev, "%s: Failed to get desc length", __func__); > + dev_err(hba->dev, "%s: Failed to get desc length\n", __func__); > + return -EINVAL; > + } > + > + if (param_offset >= buff_len) > + dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN > 0x%x, length 0x%x\n", > + __func__, param_offset, desc_id, buff_len); > return -EINVAL; > }
A brace missed! This right brace misses a left brace. Bean
