openkylin
/
platform_kernel-5.15
mirror of https://gitee.com/openkylin/platform_kernel-5.15.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

FROMGIT: scsi: ufs: core: scsi_get_lba() error fix 

When ufs initializes without scmd->device->sector_size set, scsi_get_lba()
will get a wrong shift number and trigger an ubsan error.  The shift
exponent 4294967286 is too large for the 64-bit type 'sector_t' (aka
'unsigned long long').

Call scsi_get_lba() only when opcode is READ_10/WRITE_10/UNMAP.

Link: https://lore.kernel.org/r/20220307111752.10465-1-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 2bd3b6b75946db2ace06e145d53988e10ed7e99a git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next)
Bug: 228405696
Change-Id: I5bdf04628eff2a0c2a36c89f9934033fb3d8a392
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Signed-off-by: Yee Lee <yee.lee@mediatek.com>
This commit is contained in:
Peter Wang 2022-03-07 19:17:52 +08:00 committed by Bart Van Assche
parent 6c55ca2cae
commit 7ec90fc9de
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/scsi/ufs/ufshcd.c
View File

@ -369,7 +369,7 @@ static void ufshcd_add_uic_command_trace(struct ufs_hba *hba,
static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
enum ufs_trace_str_t str_t)
{
u64 lba;
u64 lba = 0;
u8 opcode = 0, group_id = 0;
u32 intr, doorbell;
struct ufshcd_lrb *lrbp = &hba->lrb[tag];
@ -386,7 +386,6 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
return;
opcode = cmd->cmnd[0];
lba = scsi_get_lba(cmd);
if (opcode == READ_10 || opcode == WRITE_10) {
/*
@ -394,6 +393,7 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
*/
transfer_len =
be32_to_cpu(lrbp->ucd_req_ptr->sc.exp_data_transfer_len);
lba = scsi_get_lba(cmd);
if (opcode == WRITE_10)
group_id = lrbp->cmd->cmnd[6];
} else if (opcode == UNMAP) {
@ -401,6 +401,7 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
* The number of Bytes to be unmapped beginning with the lba.
*/
transfer_len = blk_rq_bytes(rq);
lba = scsi_get_lba(cmd);
}
intr = ufshcd_readl(hba, REG_INTERRUPT_STATUS);