Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Two bug fixes, both for fairly serious problems; the UFS one looks
like it could be used to exfiltrate data from the kernel, although
probably only a privileged user has access to the command management
interface and the missing unlock in smartpqi is long standing and
probably a little used error path"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous()
scsi: ufs: Check that space was properly alloced in copy_query_response
+6
-3
+4
-2
drivers/scsi/smartpqi/smartpqi_init.c
+4
-2
drivers/scsi/smartpqi/smartpqi_init.c
···
4046
4046
return -ETIMEDOUT;
4047
4047
msecs_blocked =
4048
4048
jiffies_to_msecs(jiffies - start_jiffies);
4049
-
if (msecs_blocked >= timeout_msecs)
4050
-
return -ETIMEDOUT;
4049
+
if (msecs_blocked >= timeout_msecs) {
4050
+
rc = -ETIMEDOUT;
4051
+
goto out;
4052
+
}
4051
4053
timeout_msecs -= msecs_blocked;
4052
4054
}
4053
4055
}
+2
-1
drivers/scsi/ufs/ufshcd.c
+2
-1
drivers/scsi/ufs/ufshcd.c
···
1917
1917
memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE);
1918
1918
1919
1919
/* Get the descriptor */
1920
-
if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
1920
+
if (hba->dev_cmd.query.descriptor &&
1921
+
lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
1921
1922
u8 *descp = (u8 *)lrbp->ucd_rsp_ptr +
1922
1923
GENERAL_UPIU_REQUEST_SIZE;
1923
1924
u16 resp_len;