diff options
| author | Stanley Jhu <stanleyjhu@google.com> | 2026-10-15 08:18:54 +0800 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-23 22:35:45 -0400 |
| commit | 1ae42513205a38b811afedb6797f9f9c4de37b90 (patch) | |
| tree | 07f0e2b773d33fb659b9ef9903e6b7bcc54cd56b /tools/lib/python/kdoc/python_version.py | |
| parent | 42aa443718104d10dbdb6f258810b425eb2451f8 (diff) | |
scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
ufs_bsg_request() passes the user-supplied UIC argument2 unchanged,
including the result byte (bits 7:0) that only the host controller
writes. A non-zero value triggers the WARN_ON_ONCE() in
ufshcd_dispatch_uic_cmd() and corrupts the reported result. Found by
syzkaller.
Reject UIC commands that have the result byte set with -EINVAL.
Fixes: e77044c5a842 ("scsi: ufs-bsg: Add support for uic commands in ufs_bsg_request()")
Fixes: 9fb4c793223b ("scsi: ufs: core: Complain if UIC argument 2 is invalid")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-5-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions