scsi: ufs: WB is only available on LUN #0 to #7

BugLink: https://bugs.launchpad.net/bugs/1919492
[ Upstream commit a2fca52ee640a04112ed9d9a137c940ea6ad288e ]

Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from
rpmb LUN. The reason is that the unit descriptor length is different per
LU.

The length of Normal LU is 45 while the one of rpmb LU is 35.

int ufshcd_read_desc_param(struct ufs_hba *hba, ...)
{
	param_offset=41;
	param_size=4;
	buff_len=45;
	...
	buff_len=35 by rpmb LU;

	if (is_kmalloc) {
		/* Make sure we don't copy more data than available */
		if (param_offset + param_size > buff_len)
			param_size = buff_len - param_offset;
			--> param_size = 250;
		memcpy(param_read_buf, &desc_buf[param_offset], param_size);
		--> memcpy(param_read_buf, desc_buf+41, 250);

[  141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c
	}
}

Link: https://lore.kernel.org/r/20210111095927.1830311-1-jaegeuk@kernel.org
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c
index 08e72b7eef6aaf21c480bb11d3605dbd8229e4f8..50e90416262bcc59f90291b71c4c59bcb481ec28 100644 (file)
--- a/drivers/scsi/ufs/ufs-sysfs.c
+++ b/drivers/scsi/ufs/ufs-sysfs.c
@@ -792,7 +792,8 @@ static ssize_t _pname##_show(struct device *dev,                    \
        struct scsi_device *sdev = to_scsi_device(dev);                 \
        struct ufs_hba *hba = shost_priv(sdev->host);                   \
        u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun);                    \
-       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun))           \
+       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun,            \
+                               _duname##_DESC_PARAM##_puname))         \
                return -EINVAL;                                         \
        return ufs_sysfs_read_desc_param(hba, QUERY_DESC_IDN_##_duname, \
                lun, _duname##_DESC_PARAM##_puname, buf, _size);        \

diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index 14dfda735adf5ac2c2a06d779724f706adbfee62..580aa56965d065d894cbc19ea3c775ead31cb050 100644 (file)
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -552,13 +552,15 @@ struct ufs_dev_info {
  * @return: true if the lun has a matching unit descriptor, false otherwise
  */
 static inline bool ufs_is_valid_unit_desc_lun(struct ufs_dev_info *dev_info,
-               u8 lun)
+               u8 lun, u8 param_offset)
 {
        if (!dev_info || !dev_info->max_lu_supported) {
                pr_err("Max General LU supported by UFS isn't initialized\n");
                return false;
        }
-
+       /* WB is available only for the logical unit from 0 to 7 */
+       if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS)
+               return lun < UFS_UPIU_MAX_WB_LUN_ID;
        return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info->max_lu_supported);
 }
 

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 428b9e0ac47e9957a3886b9ffbbe25b7db5127ff..a568f7ae05660884569b5e90b9a3e16647cec8a7 100644 (file)
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3427,7 +3427,7 @@ static inline int ufshcd_read_unit_desc_param(struct ufs_hba *hba,
         * Unit descriptors are only available for general purpose LUs (LUN id
         * from 0 to 7) and RPMB Well known LU.
         */
-       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun))
+       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, param_offset))
                return -EOPNOTSUPP;
 
        return ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT, lun,