Commit d8191b7f authored by Arthur Simchaev's avatar Arthur Simchaev Committed by Xiangwei Li
Browse files

scsi: ufs: core: bsg: Fix crash when arpmb command fails 

stable inclusion
from stable-v6.6.81
commit 32fb5ec825f6f76bc28902181c65429a904a07fe
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSZ
CVE: CVE-2025-21873

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=32fb5ec825f6f76bc28902181c65429a904a07fe



--------------------------------

commit f27a95845b01e86d67c8b014b4f41bd3327daa63 upstream.

If the device doesn't support arpmb we'll crash due to copying user data in
bsg_transport_sg_io_fn().

In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not
set the job's reply_len.

Memory crash backtrace:
3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22

4,1308,531166555,-;Call Trace:

4,1309,531166559,-; <TASK>

4,1310,531166565,-; ? show_regs+0x6d/0x80

4,1311,531166575,-; ? die+0x37/0xa0

4,1312,531166583,-; ? do_trap+0xd4/0xf0

4,1313,531166593,-; ? do_error_trap+0x71/0xb0

4,1314,531166601,-; ? usercopy_abort+0x6c/0x80

4,1315,531166610,-; ? exc_invalid_op+0x52/0x80

4,1316,531166622,-; ? usercopy_abort+0x6c/0x80

4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20

4,1318,531166643,-; ? usercopy_abort+0x6c/0x80

4,1319,531166652,-; __check_heap_object+0xe3/0x120

4,1320,531166661,-; check_heap_object+0x185/0x1d0

4,1321,531166670,-; __check_object_size.part.0+0x72/0x150

4,1322,531166679,-; __check_object_size+0x23/0x30

4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0

Fixes: 6ff265fc ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarBean Huo <beanhuo@micron.com>
Signed-off-by: default avatarArthur Simchaev <arthur.simchaev@sandisk.com>
Link: https://lore.kernel.org/r/20250220142039.250992-1-arthur.simchaev@sandisk.com


Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarXiangwei Li <liwei728@huawei.com>
parent 75db7d4f

drivers/ufs/core/ufs_bsg.c

+4 −2
Original line number Diff line number Diff line
@@ -194,10 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job) 
	ufshcd_rpm_put_sync(hba);

	kfree(buff);

	bsg_reply->result = ret;

	job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply);

	/* complete the job here only if no error */

	if (ret == 0)

	if (ret == 0) {

		job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) :

					sizeof(struct ufs_bsg_reply);

		bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);

	}



	return ret;

}