Commit 64d48647 authored by Bean Huo's avatar Bean Huo Committed by Martin K. Petersen
Browse files

scsi: ufs: bsg: Remove unnecessary length checkup 



Remove checks on job->request_len and job->reply_len because msgcode checks
in a subseqent commit will rule out malicious requests.

Signed-off-by: default avatarBean Huo <beanhuo@micron.com>
Acked-by: default avatarAvri Altman <avri.altman@wdc.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 3f5145a6

drivers/ufs/core/ufs_bsg.c

+0 −21
Original line number Diff line number Diff line
@@ -30,21 +30,6 @@ static int ufs_bsg_get_query_desc_size(struct ufs_hba *hba, int *desc_len, 
	return 0;

}



static int ufs_bsg_verify_query_size(struct ufs_hba *hba,

				     unsigned int request_len,

				     unsigned int reply_len)

{

	int min_req_len = sizeof(struct ufs_bsg_request);

	int min_rsp_len = sizeof(struct ufs_bsg_reply);



	if (min_req_len > request_len || min_rsp_len > reply_len) {

		dev_err(hba->dev, "not enough space assigned\n");

		return -EINVAL;

	}



	return 0;

}



static int ufs_bsg_alloc_desc_buffer(struct ufs_hba *hba, struct bsg_job *job,

				     uint8_t **desc_buff, int *desc_len,

				     enum query_opcode desc_op)
@@ -88,8 +73,6 @@ static int ufs_bsg_request(struct bsg_job *job) 
	struct ufs_bsg_request *bsg_request = job->request;

	struct ufs_bsg_reply *bsg_reply = job->reply;

	struct ufs_hba *hba = shost_priv(dev_to_shost(job->dev->parent));

	unsigned int req_len = job->request_len;

	unsigned int reply_len = job->reply_len;

	struct uic_command uc = {};

	int msgcode;

	uint8_t *desc_buff = NULL;
@@ -97,10 +80,6 @@ static int ufs_bsg_request(struct bsg_job *job) 
	enum query_opcode desc_op = UPIU_QUERY_OPCODE_NOP;

	int ret;



	ret = ufs_bsg_verify_query_size(hba, req_len, reply_len);

	if (ret)

		goto out;



	bsg_reply->reply_payload_rcv_len = 0;



	ufshcd_rpm_get_sync(hba);