diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2019-06-08 20:54:17 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-06-08 20:54:17 +0200 |
| commit | 1b02caa319cf73ae89aced8714066a3a5bbe648b (patch) | |
| tree | 1b968ce679b42bb56b4a5a95492bd15606644d47 /drivers/scsi/ufs | |
| parent | Merge tag 'linux-kselftest-5.2-rc4-2' of git://git.kernel.org/pub/scm/linux/k... (diff) | |
| parent | scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous() (diff) | |
| download | linux-1b02caa319cf73ae89aced8714066a3a5bbe648b.tar.xz linux-1b02caa319cf73ae89aced8714066a3a5bbe648b.zip | |
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Two bug fixes, both for fairly serious problems; the UFS one looks
like it could be used to exfiltrate data from the kernel, although
probably only a privileged user has access to the command management
interface and the missing unlock in smartpqi is long standing and
probably a little used error path"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous()
scsi: ufs: Check that space was properly alloced in copy_query_response
Diffstat (limited to 'drivers/scsi/ufs')
| -rw-r--r-- | drivers/scsi/ufs/ufshcd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 8c1c551f2b42..3fe3029617a8 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -1917,7 +1917,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE); /* Get the descriptor */ - if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { + if (hba->dev_cmd.query.descriptor && + lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { u8 *descp = (u8 *)lrbp->ucd_rsp_ptr + GENERAL_UPIU_REQUEST_SIZE; u16 resp_len; |