scsi: ufs: WB is only available on LUN #0 to #7
authorJaegeuk Kim <jaegeuk@kernel.org>
Mon, 11 Jan 2021 09:59:27 +0000 (01:59 -0800)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 13 Jan 2021 05:27:46 +0000 (00:27 -0500)
commita2fca52ee640a04112ed9d9a137c940ea6ad288e
tree4903820f56760fd3237aed02a09309ef25415934
parentdc0d9b12b8a74f5435097ebc7aafca76ba9cda7a
scsi: ufs: WB is only available on LUN #0 to #7

Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from
rpmb LUN. The reason is that the unit descriptor length is different per
LU.

The length of Normal LU is 45 while the one of rpmb LU is 35.

int ufshcd_read_desc_param(struct ufs_hba *hba, ...)
{
param_offset=41;
param_size=4;
buff_len=45;
...
buff_len=35 by rpmb LU;

if (is_kmalloc) {
/* Make sure we don't copy more data than available */
if (param_offset + param_size > buff_len)
param_size = buff_len - param_offset;
--> param_size = 250;
memcpy(param_read_buf, &desc_buf[param_offset], param_size);
--> memcpy(param_read_buf, desc_buf+41, 250);

[  141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c
}
}

Link: https://lore.kernel.org/r/20210111095927.1830311-1-jaegeuk@kernel.org
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/ufs/ufs-sysfs.c
drivers/scsi/ufs/ufs.h
drivers/scsi/ufs/ufshcd.c