scsi: ufs: WB is only available on LUN #0 to #7

Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from
rpmb LUN. The reason is that the unit descriptor length is different per
LU.

The length of Normal LU is 45 while the one of rpmb LU is 35.

int ufshcd_read_desc_param(struct ufs_hba *hba, ...)
{
	param_offset=41;
	param_size=4;
	buff_len=45;
	...
	buff_len=35 by rpmb LU;

	if (is_kmalloc) {
		/* Make sure we don't copy more data than available */
		if (param_offset + param_size > buff_len)
			param_size = buff_len - param_offset;
			--> param_size = 250;
		memcpy(param_read_buf, &desc_buf[param_offset], param_size);
		--> memcpy(param_read_buf, desc_buf+41, 250);

[  141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c
	}
}

Link: https://lore.kernel.org/r/20210111095927.1830311-1-jaegeuk@kernel.org
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c
index 0e14384851338897cee708c6a39f898ad786d326..8921700f4f724ad29405ee1d60da215db21ec5e7 100644 (file)
--- a/drivers/scsi/ufs/ufs-sysfs.c
+++ b/drivers/scsi/ufs/ufs-sysfs.c
@@ -792,7 +792,8 @@ static ssize_t _pname##_show(struct device *dev,                    \
        struct scsi_device *sdev = to_scsi_device(dev);                 \
        struct ufs_hba *hba = shost_priv(sdev->host);                   \
        u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun);                    \
-       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun))           \
+       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun,            \
+                               _duname##_DESC_PARAM##_puname))         \
                return -EINVAL;                                         \
        return ufs_sysfs_read_desc_param(hba, QUERY_DESC_IDN_##_duname, \
                lun, _duname##_DESC_PARAM##_puname, buf, _size);        \

diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index 50f46f3bc8a21f7211426c2ad178ab50502c762a..09c7cc8a678d4d47c55cf42a07346c85347d41c6 100644 (file)
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -569,13 +569,15 @@ enum ufs_trace_tsf_t {
  * @return: true if the lun has a matching unit descriptor, false otherwise
  */
 static inline bool ufs_is_valid_unit_desc_lun(struct ufs_dev_info *dev_info,
-               u8 lun)
+               u8 lun, u8 param_offset)
 {
        if (!dev_info || !dev_info->max_lu_supported) {
                pr_err("Max General LU supported by UFS isn't initialized\n");
                return false;
        }
-
+       /* WB is available only for the logical unit from 0 to 7 */
+       if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS)
+               return lun < UFS_UPIU_MAX_WB_LUN_ID;
        return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info->max_lu_supported);
 }
 

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 5c5edb737c002f53e530267d59c558eeab0a140f..cc8d00343b9efc0d2a1cd36c127788f8f5586e48 100644 (file)
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3439,7 +3439,7 @@ static inline int ufshcd_read_unit_desc_param(struct ufs_hba *hba,
         * Unit descriptors are only available for general purpose LUs (LUN id
         * from 0 to 7) and RPMB Well known LU.
         */
-       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun))
+       if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, param_offset))
                return -EOPNOTSUPP;
 
        return ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT, lun,