Re: [PATCH v2 2/5] scsi: ufs: bsg: Clear the reply buffer before use

Re: [PATCH v2 2/5] scsi: ufs: bsg: Clear the reply buffer before use

[Stanley Jhu]

On Thu, Oct 15, 2026 at 12:34:36AM +0000, sashiko-bot@kernel.org wrote:
> Will this copy write 64 bytes starting at offset 40, exceeding the 96-byte
> allocation by 8 bytes and corrupting out-of-bounds memory?

Pre-existing; fixed separately in bsg-lib, which sizes the reply buffer
to 104 bytes for UFS:
https://lore.kernel.org/all/20261013132708.1669415-1-stanleyjhu@google.com/

[PATCH v2 0/5] scsi: ufs: Fix UIC result byte and BSG request handling

[Stanley Jhu]

ufs-bsg fixes for issues found by fuzzing /dev/bsg/ufs-bsg* with
syzkaller on QEMU's emulated UFS host controller and in review of v1,
plus a fix for peer DME retries.

Patch 1 completes failed BSG requests via bsg_job_done() so error paths
do not leak the job's device reference and mapped scatterlists.
Patch 2 clears the reused reply buffer so replies do not carry bytes
from an earlier request.
Patch 3 rejects requests shorter than the UFS BSG request structures.
Patch 4 rejects UIC commands with a non-zero result byte from userspace.
Patch 5 clears the stale UIC result byte and restores argument3 before
peer DME retries.

Patches 1-2 also address the sashiko review of the bsg reply_len patch:
https://lore.kernel.org/all/sashiko-outbox-169843@kernel.org/

Tested on QEMU arm64: the reproducers no longer trigger.

Differences from v1:
- New patch 1/5: complete failed jobs via bsg_job_done().
- New patch 2/5: clear the reply buffer on entry.
- Patch 4/5: reject non-zero UIC result byte with -EINVAL (Bart).
- Patch 5/5: restore argument3 on each retry in ufshcd_dme_set_attr().

Link: https://lore.kernel.org/all/20261013102913.948718-1-stanleyjhu@google.com/

Stanley Jhu (5):
  scsi: ufs: bsg: Complete the job on error
  scsi: ufs: bsg: Clear the reply buffer before use
  scsi: ufs: bsg: Validate request_len before accessing request
  scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
  scsi: ufs: core: Clear stale UIC result byte before peer DME retries

 drivers/ufs/core/ufs_bsg.c | 23 +++++++++++++++++------
 drivers/ufs/core/ufshcd.c  |  9 +++++++--
 2 files changed, 24 insertions(+), 8 deletions(-)

base-commit: 9621cbd332862eb6651e2aba24ed18f66560de66
-- 
2.56.0.385.gd3acb90ef8-goog

[PATCH v2 2/5] scsi: ufs: bsg: Clear the reply buffer before use

[Stanley Jhu]

The reply buffer is allocated once per tag and reused. Requests that
complete with a positive status do not fill all of it, so user space
receives bytes from an earlier request on the same tag.

Clear the whole reply buffer on entry to ufs_bsg_request().

Fixes: 95e34bf930ea ("scsi: ufs-bsg: Add support for raw upiu in ufs_bsg_request()")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
 drivers/ufs/core/ufs_bsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
index 18c318d78122..545ef7b79ceb 100644
--- a/drivers/ufs/core/ufs_bsg.c
+++ b/drivers/ufs/core/ufs_bsg.c
@@ -140,7 +140,7 @@ static int ufs_bsg_request(struct bsg_job *job)
 	int ret;
 	bool rpmb = false;
 
-	bsg_reply->reply_payload_rcv_len = 0;
+	memset(job->reply, 0, job->reply_len);
 
 	ufshcd_rpm_get_sync(hba);
 
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [PATCH v2 2/5] scsi: ufs: bsg: Clear the reply buffer before use

[Bean Huo]

Reviewed-by: Bean Huo <beanhuo@micron.com>