Pull SCSI fixes from James Bottomley: "Two bug fixes, both for fairly serious problems; the UFS one looks like it could be used to exfiltrate data from the kernel, although probably only a privileged user has access to the command management interface and the missing unlock in smartpqi is long standing and probably a little used error path" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: smartpqi: unlock on error in pqi_submit_raid_request_synchronous() scsi: ufs: Check that space was properly alloced in copy_query_response
Unified · Split
| @@ -4046,8 +4046,10 @@ static int pqi_submit_raid_request_synchronous(struct pqi_ctrl_info *ctrl_info, · 4045 unmodified lines | |||
| 4046 | return -ETIMEDOUT; | 4046 | return -ETIMEDOUT; |
| 4047 | msecs_blocked = | 4047 | msecs_blocked = |
| 4048 | jiffies_to_msecs(jiffies - start_jiffies); | 4048 | jiffies_to_msecs(jiffies - start_jiffies); |
| 4049 | if (msecs_blocked >= timeout_msecs) | 4049 | if (msecs_blocked >= timeout_msecs) { |
| 4050 | return -ETIMEDOUT; | 4050 | rc = -ETIMEDOUT; |
| 4051 | goto out; | ||
| 4052 | } | ||
| 4051 | timeout_msecs -= msecs_blocked; | 4053 | timeout_msecs -= msecs_blocked; |
| 4052 | } | 4054 | } |
| 4053 | } | 4055 | } |
| @@ -1917,7 +1917,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) · 1916 unmodified lines | |||
| 1917 | memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE); | 1917 | memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE); |
| 1918 | 1918 | ||
| 1919 | /* Get the descriptor */ | 1919 | /* Get the descriptor */ |
| 1920 | if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { | 1920 | if (hba->dev_cmd.query.descriptor && |
| 1921 | lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { | ||
| 1921 | u8 *descp = (u8 *)lrbp->ucd_rsp_ptr + | 1922 | u8 *descp = (u8 *)lrbp->ucd_rsp_ptr + |
| 1922 | GENERAL_UPIU_REQUEST_SIZE; | 1923 | GENERAL_UPIU_REQUEST_SIZE; |
| 1923 | u16 resp_len; | 1924 | u16 resp_len; |