Commit 4728ab4a authored by Bart Van Assche's avatar Bart Van Assche Committed by Martin K. Petersen
Browse files

scsi: ufs: Remove ufshcd_valid_tag() 

scsi_add_host() allocates shost->can_queue tags. ufshcd_init() sets
shost->can_queue to hba->nutrs. In other words, we know that tag values
will less than hba->nutrs. Hence remove the checks that verify that
blk_get_request() returns a tag less than hba->nutrs. This check was
introduced by commit 14497328 ("scsi: ufs: verify command tag
validity").

Keep the tag >= 0 check because it helps to detect use-after-free issues.

Link: https://lore.kernel.org/r/20210722033439.26550-7-bvanassche@acm.org


CC: Avri Altman <avri.altman@wdc.com>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: default avatarBean Huo <beanhuo@micron.com>
Reviewed-by: default avatarDaejun Park <daejun7.park@samsung.com>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 8a686f26

drivers/scsi/ufs/ufshcd.c

+10 −32
Original line number Diff line number Diff line
@@ -253,11 +253,6 @@ static inline void ufshcd_wb_toggle_flush(struct ufs_hba *hba, bool enable); 
static void ufshcd_hba_vreg_set_lpm(struct ufs_hba *hba);

static void ufshcd_hba_vreg_set_hpm(struct ufs_hba *hba);



static inline bool ufshcd_valid_tag(struct ufs_hba *hba, int tag)

{

	return tag >= 0 && tag < hba->nutrs;

}



static inline void ufshcd_enable_irq(struct ufs_hba *hba)

{

	if (!hba->is_irq_enabled) {
@@ -2701,20 +2696,12 @@ static void ufshcd_init_lrb(struct ufs_hba *hba, struct ufshcd_lrb *lrb, int i) 
 */

static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)

{

	struct ufs_hba *hba = shost_priv(host);

	int tag = cmd->request->tag;

	struct ufshcd_lrb *lrbp;

	struct ufs_hba *hba;

	int tag;

	int err = 0;



	hba = shost_priv(host);



	tag = cmd->request->tag;

	if (!ufshcd_valid_tag(hba, tag)) {

		dev_err(hba->dev,

			"%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",

			__func__, tag, cmd, cmd->request);

		BUG();

	}

	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);



	if (!down_read_trylock(&hba->clk_scaling_lock))

		return SCSI_MLQUEUE_HOST_BUSY;
@@ -2975,7 +2962,7 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, 
		goto out_unlock;

	}

	tag = req->tag;

	WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));

	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);

	/* Set the timeout such that the SCSI error handler is not activated. */

	req->timeout = msecs_to_jiffies(2 * timeout);

	blk_mq_start_request(req);
@@ -6713,7 +6700,7 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba, 
		goto out_unlock;

	}

	tag = req->tag;

	WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));

	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);



	if (unlikely(test_bit(tag, &hba->outstanding_reqs))) {

		err = -EBUSY;
@@ -7015,24 +7002,15 @@ static int ufshcd_try_to_abort_task(struct ufs_hba *hba, int tag) 
 */

static int ufshcd_abort(struct scsi_cmnd *cmd)

{

	struct Scsi_Host *host;

	struct ufs_hba *hba;

	struct Scsi_Host *host = cmd->device->host;

	struct ufs_hba *hba = shost_priv(host);

	unsigned int tag = cmd->request->tag;

	struct ufshcd_lrb *lrbp = &hba->lrb[tag];

	unsigned long flags;

	unsigned int tag;

	int err = 0;

	struct ufshcd_lrb *lrbp;

	u32 reg;



	host = cmd->device->host;

	hba = shost_priv(host);

	tag = cmd->request->tag;

	lrbp = &hba->lrb[tag];

	if (!ufshcd_valid_tag(hba, tag)) {

		dev_err(hba->dev,

			"%s: invalid command tag %d: cmd=0x%p, cmd->request=0x%p",

			__func__, tag, cmd, cmd->request);

		BUG();

	}

	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);



	ufshcd_hold(hba, false);

	reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);