scsi: ufs: fix bugs related to null pointer access and array size

In this change there are a few fixes of possible NULL pointer access and
possible access to index that exceeds array boundaries.

Signed-off-by: Yaniv Gardi <ygardi@codeaurora.org>
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index 845b874e29773883e9469db83bcd5b9b9656269c..7a6ccb680049232b0157a61bfbb9ef252d72ab9f 100644 (file)
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -46,6 +46,7 @@
 #define QUERY_DESC_HDR_SIZE       2
 #define QUERY_OSF_SIZE            (GENERAL_UPIU_REQUEST_SIZE - \
                                        (sizeof(struct utp_upiu_header)))
+#define RESPONSE_UPIU_SENSE_DATA_LENGTH        18
 
 #define UPIU_HEADER_DWORD(byte3, byte2, byte1, byte0)\
                        cpu_to_be32((byte3 << 24) | (byte2 << 16) |\
@@ -416,7 +417,7 @@ struct utp_cmd_rsp {
        __be32 residual_transfer_count;
        __be32 reserved[4];
        __be16 sense_data_len;
-       u8 sense_data[18];
+       u8 sense_data[RESPONSE_UPIU_SENSE_DATA_LENGTH];
 };
 
 /**

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 571a2f64a01d71e654ed91a87779ac4db2f5791c..d46709ed05557cbfad991ac72eee6f31c58f6d98 100644 (file)
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -889,10 +889,14 @@ static inline void ufshcd_copy_sense_data(struct ufshcd_lrb *lrbp)
        int len;
        if (lrbp->sense_buffer &&
            ufshcd_get_rsp_upiu_data_seg_len(lrbp->ucd_rsp_ptr)) {
+               int len_to_copy;
+
                len = be16_to_cpu(lrbp->ucd_rsp_ptr->sr.sense_data_len);
+               len_to_copy = min_t(int, RESPONSE_UPIU_SENSE_DATA_LENGTH, len);
+
                memcpy(lrbp->sense_buffer,
                        lrbp->ucd_rsp_ptr->sr.sense_data,
-                       min_t(int, len, SCSI_SENSE_BUFFERSIZE));
+                       min_t(int, len_to_copy, SCSI_SENSE_BUFFERSIZE));
        }
 }
 
@@ -6091,7 +6095,10 @@ EXPORT_SYMBOL(ufshcd_system_suspend);
 
 int ufshcd_system_resume(struct ufs_hba *hba)
 {
-       if (!hba || !hba->is_powered || pm_runtime_suspended(hba->dev))
+       if (!hba)
+               return -EINVAL;
+
+       if (!hba->is_powered || pm_runtime_suspended(hba->dev))
                /*
                 * Let the runtime resume take care of resuming
                 * if runtime suspended.
@@ -6112,7 +6119,10 @@ EXPORT_SYMBOL(ufshcd_system_resume);
  */
 int ufshcd_runtime_suspend(struct ufs_hba *hba)
 {
-       if (!hba || !hba->is_powered)
+       if (!hba)
+               return -EINVAL;
+
+       if (!hba->is_powered)
                return 0;
 
        return ufshcd_suspend(hba, UFS_RUNTIME_PM);
@@ -6142,10 +6152,13 @@ EXPORT_SYMBOL(ufshcd_runtime_suspend);
  */
 int ufshcd_runtime_resume(struct ufs_hba *hba)
 {
-       if (!hba || !hba->is_powered)
+       if (!hba)
+               return -EINVAL;
+
+       if (!hba->is_powered)
                return 0;
-       else
-               return ufshcd_resume(hba, UFS_RUNTIME_PM);
+
+       return ufshcd_resume(hba, UFS_RUNTIME_PM);
 }
 EXPORT_SYMBOL(ufshcd_runtime_resume);