Re: [PATCH v2 1/5] scsi: ufs: bsg: Complete the job on error

Re: [PATCH v2 1/5] scsi: ufs: bsg: Complete the job on error

[Stanley Jhu]

On Thu, Oct 15, 2026 at 12:32:09AM +0000, sashiko-bot@kernel.org wrote:
> Because job->reply_len is set to 104, this copies 8 bytes of adjacent
> slab memory to userspace, which could lead to heap corruption and
> memory disclosure.

Pre-existing and not changed by this patch; fixed separately in bsg-lib:
https://lore.kernel.org/all/20261013132708.1669415-1-stanleyjhu@google.com/

Re: [PATCH v2 1/5] scsi: ufs: bsg: Complete the job on error

[Bean Huo]

On Thu, 2026-10-15 at 08:18 +0800, Stanley Jhu wrote:
> index 7a66917b3fc0..18c318d78122 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -195,14 +195,12 @@ static int ufs_bsg_request(struct bsg_job *job)
>         ufshcd_rpm_put_sync(hba);
>         kfree(buff);
>         bsg_reply->result = ret;
> -       /* complete the job here only if no error */
> -       if (ret == 0) {
> +       if (ret == 0)
>                 job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) :
>                                         sizeof(struct ufs_bsg_reply);
> -               bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
> -       }
> +       bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);

Since the old comment is gone, it's better to add a short one before
bsg_job_done() saying we must always complete the job and return 0?

otherwise a later change could easily bring back either the leak or the double
completion that b13a3539eb2a fixed?

Reviewed-by: Bean Huo <beanhuo@micron.com>

>  
> -       return ret;
> +       return 0;
>  }

[PATCH v2 1/5] scsi: ufs: bsg: Complete the job on error

[Stanley Jhu]

When ufs_bsg_request() fails, it returns a non-zero status without
calling bsg_job_done(). bsg_queue_rq() then ends the request with
BLK_STS_IOERR without running bsg_complete(), leaking the job's device
reference and mapped scatterlists.

Always complete the job via bsg_job_done() and return 0, matching other
BSG transports. Requests failing with a negative errno now return it
from SG_IO with the 4-byte result in the reply, while positive status
codes still return 0 from SG_IO with the reply header.

Fixes: b13a3539eb2a ("scsi: ufs-bsg: complete ufs-bsg job only if no error")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
 drivers/ufs/core/ufs_bsg.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 7a66917b3fc0..18c318d78122 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -195,14 +195,12 @@ static int ufs_bsg_request(struct bsg_job *job)
 	ufshcd_rpm_put_sync(hba);
 	kfree(buff);
 	bsg_reply->result = ret;
-	/* complete the job here only if no error */
-	if (ret == 0) {
+	if (ret == 0)
 		job->reply_len = rpmb ? sizeof(struct ufs_rpmb_reply) :
 					sizeof(struct ufs_bsg_reply);
-		bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
-	}
+	bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
 
-	return ret;
+	return 0;
 }
 
 /**
-- 
2.56.0.385.gd3acb90ef8-goog