From b6f0e756f3ba8d004a3a2ae07e37601c7e218142 Mon Sep 17 00:00:00 2001 From: Arthur Simchaev Date: Sun, 11 Dec 2022 15:05:11 +0200 Subject: [PATCH] FROMGIT: scsi: ufs: core: Remove ufshcd_map_desc_id_to_length() There shouldn't be any restriction of the descriptor size (not the descriptor id for that matter) up to QUERY_DESC_MAX_SIZE. According to the spec, the caller can use any descriptor size, and it is up to the device to return the actual size. Therefore there shouldn't be any sizes hardcoded in the kernel, nor any need to cache it, hence the ufshcd_map_desc_id_to_length() function is redundant. Always read the descriptors with QUERY_DESC_MAX_SIZE size. Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Suggested-by: Bean Huo Change-Id: I7933da0b7ec3771b9faccb2c8fe05bb83f741162 Signed-off-by: Arthur Simchaev Signed-off-by: Martin K. Petersen Bug: 258234315 (cherry picked from commit 16ed9d312b42180242476d159dd2fab05129029a git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next) Signed-off-by: Bart Van Assche --- drivers/ufs/core/ufshcd.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index dbfccc891e7e..ffa89271f5f8 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -3485,12 +3485,6 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, if (desc_id >= QUERY_DESC_IDN_MAX || !param_size) return -EINVAL; - if (param_offset >= buff_len) { - dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN 0x%x, length 0x%x\n", - __func__, param_offset, desc_id, buff_len); - return -EINVAL; - } - /* Check whether we need temp memory */ if (param_offset != 0 || param_size < buff_len) { desc_buf = kzalloc(buff_len, GFP_KERNEL); @@ -3503,15 +3497,23 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, /* Request for full descriptor */ ret = ufshcd_query_descriptor_retry(hba, UPIU_QUERY_OPCODE_READ_DESC, - desc_id, desc_index, 0, - desc_buf, &buff_len); - + desc_id, desc_index, 0, + desc_buf, &buff_len); if (ret) { dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d\n", __func__, desc_id, desc_index, param_offset, ret); goto out; } + /* Update descriptor length */ + buff_len = desc_buf[QUERY_DESC_LENGTH_OFFSET]; + + if (param_offset >= buff_len) { + dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN 0x%x, length 0x%x\n", + __func__, param_offset, desc_id, buff_len); + return -EINVAL; + } + /* Sanity check */ if (desc_buf[QUERY_DESC_DESC_TYPE_OFFSET] != desc_id) { dev_err(hba->dev, "%s: invalid desc_id %d in descriptor header\n", @@ -3520,9 +3522,6 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, goto out; } - /* Update descriptor length */ - buff_len = desc_buf[QUERY_DESC_LENGTH_OFFSET]; - if (is_kmalloc) { /* Make sure we don't copy more data than available */ if (param_offset >= buff_len)