Re: [PATCH 1/3] scsi: ufs: bsg: Validate request_len before accessing request

Re: [PATCH 1/3] scsi: ufs: bsg: Validate request_len before accessing request

[Stanley Jhu]

On Tue, Oct 13, 2026 at 10:44:34AM +0000, sashiko-bot@kernel.org wrote:
> Later, ufs_bsg_request() sets job->reply_len to 104 for RPMB replies,
> which configures the block layer to copy 104 bytes to user space from
> this 96-byte allocation. Will this leak adjacent heap memory to userspace?

Pre-existing; fixed separately in bsg-lib:
https://lore.kernel.org/all/20261013132708.1669415-1-stanleyjhu@google.com/

> Should this error path instead call bsg_job_done(job, -EINVAL, 0)
> and return 0 to ensure proper teardown?

Yes, done in v2 (1/5 and 3/5):
https://lore.kernel.org/all/20261015001855.3450573-1-stanleyjhu@google.com/

Re: [PATCH 1/3] scsi: ufs: bsg: Validate request_len before accessing request

[Bean Huo]

On Tue, 2026-10-13 at 18:29 +0800, Stanley Jhu wrote:
> ufs_bsg_request() and ufs_bsg_exec_advanced_rpmb_req() read the
> request buffer without checking job->request_len, which userspace
> controls. A short request causes an out-of-bounds read. Found by
> syzkaller.
> 
> Reject requests shorter than the structure each path reads.
> 
> Fixes: 64d4864714c2 ("scsi: ufs: bsg: Remove unnecessary length checkup")
> Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in
> ufs_bsg")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
> ---
>  drivers/ufs/core/ufs_bsg.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
> index 7a66917b3fc0..dab1f05aff38 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -73,6 +73,9 @@ static int ufs_bsg_exec_advanced_rpmb_req(struct ufs_hba
> *hba, struct bsg_job *j
>         if (hba->ufs_version < ufshci_version(4, 0) || !hba-
> >dev_info.b_advanced_rpmb_en)
>                 return -EINVAL;
>  
> +       if (job->request_len < sizeof(*rpmb_request))
> +               return -EINVAL;
> +
>         if (rpmb_request->ehs_req.length != 2 || rpmb_request-
> >ehs_req.ehs_type != 1)
>                 return -EINVAL;
>  
> @@ -142,6 +145,11 @@ static int ufs_bsg_request(struct bsg_job *job)
>  
>         bsg_reply->reply_payload_rcv_len = 0;
>  
> +       if (job->request_len < sizeof(*let )) {
> +               bsg_reply->result = -EINVAL;
> +               return -EINVAL;
> +       }
> +
>         ufshcd_rpm_get_sync(hba);
>  
>         msgcode = bsg_request->msgcode;

Stanley, 

The check was removed by my commit 64d4864714c2 when adding arpmb support, since
msgcode check was thought to be enough, thanks for fixing it. 


Reviewed-by: Bean Huo <beanhuo@micron.com>

[PATCH 1/3] scsi: ufs: bsg: Validate request_len before accessing request

[Stanley Jhu]

ufs_bsg_request() and ufs_bsg_exec_advanced_rpmb_req() read the
request buffer without checking job->request_len, which userspace
controls. A short request causes an out-of-bounds read. Found by
syzkaller.

Reject requests shorter than the structure each path reads.

Fixes: 64d4864714c2 ("scsi: ufs: bsg: Remove unnecessary length checkup")
Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
 drivers/ufs/core/ufs_bsg.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 7a66917b3fc0..dab1f05aff38 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -73,6 +73,9 @@ static int ufs_bsg_exec_advanced_rpmb_req(struct ufs_hba *hba, struct bsg_job *j
 	if (hba->ufs_version < ufshci_version(4, 0) || !hba->dev_info.b_advanced_rpmb_en)
 		return -EINVAL;
 
+	if (job->request_len < sizeof(*rpmb_request))
+		return -EINVAL;
+
 	if (rpmb_request->ehs_req.length != 2 || rpmb_request->ehs_req.ehs_type != 1)
 		return -EINVAL;
 
@@ -142,6 +145,11 @@ static int ufs_bsg_request(struct bsg_job *job)
 
 	bsg_reply->reply_payload_rcv_len = 0;
 
+	if (job->request_len < sizeof(*bsg_request)) {
+		bsg_reply->result = -EINVAL;
+		return -EINVAL;
+	}
+
 	ufshcd_rpm_get_sync(hba);
 
 	msgcode = bsg_request->msgcode;
-- 
2.56.0.385.gd3acb90ef8-goog