Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: ufs: core: scsi_get_lba() error fix

When ufs initializes without scmd->device->sector_size set, scsi_get_lba()
will get a wrong shift number and trigger an ubsan error. The shift
exponent 4294967286 is too large for the 64-bit type 'sector_t' (aka
'unsigned long long').

Call scsi_get_lba() only when opcode is READ_10/WRITE_10/UNMAP.

Link: https://lore.kernel.org/r/20220307111752.10465-1-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Peter Wang and committed by
Martin K. Petersen
2bd3b6b7 296559d4

+3 -2
+3 -2
drivers/scsi/ufs/ufshcd.c
··· 365 365 static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag, 366 366 enum ufs_trace_str_t str_t) 367 367 { 368 - u64 lba; 368 + u64 lba = 0; 369 369 u8 opcode = 0, group_id = 0; 370 370 u32 intr, doorbell; 371 371 struct ufshcd_lrb *lrbp = &hba->lrb[tag]; ··· 382 382 return; 383 383 384 384 opcode = cmd->cmnd[0]; 385 - lba = scsi_get_lba(cmd); 386 385 387 386 if (opcode == READ_10 || opcode == WRITE_10) { 388 387 /* ··· 389 390 */ 390 391 transfer_len = 391 392 be32_to_cpu(lrbp->ucd_req_ptr->sc.exp_data_transfer_len); 393 + lba = scsi_get_lba(cmd); 392 394 if (opcode == WRITE_10) 393 395 group_id = lrbp->cmd->cmnd[6]; 394 396 } else if (opcode == UNMAP) { ··· 397 397 * The number of Bytes to be unmapped beginning with the lba. 398 398 */ 399 399 transfer_len = blk_rq_bytes(rq); 400 + lba = scsi_get_lba(cmd); 400 401 } 401 402 402 403 intr = ufshcd_readl(hba, REG_INTERRUPT_STATUS);