From: Peter Wang <peter.wang@mediatek.com>
Date: Mon, 7 Mar 2022 19:17:52 +0800
Subject: scsi: ufs: core: scsi_get_lba() error fix
Git-commit: 2bd3b6b75946db2ace06e145d53988e10ed7e99a
Patch-mainline: v5.18-rc1
References: git-fixes
When ufs initializes without scmd->device->sector_size set, scsi_get_lba()
will get a wrong shift number and trigger an ubsan error. The shift
exponent 4294967286 is too large for the 64-bit type 'sector_t' (aka
'unsigned long long').
Call scsi_get_lba() only when opcode is READ_10/WRITE_10/UNMAP.
[lduncan: hand modified then refreshed to apply]
Link: https://lore.kernel.org/r/20220307111752.10465-1-peter.wang@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Lee Duncan <lduncan@suse.com>
---
drivers/scsi/ufs/ufshcd.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -370,7 +370,7 @@ static void ufshcd_add_uic_command_trace
static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
enum ufs_trace_str_t str_t)
{
- u64 lba = -1;
+ u64 lba = 0;
u8 opcode = 0, group_id = 0;
u32 intr, doorbell;
struct ufshcd_lrb *lrbp = &hba->lrb[tag];
@@ -389,7 +389,6 @@ static void ufshcd_add_command_trace(str
/* trace UPIU also */
ufshcd_add_cmd_upiu_trace(hba, tag, str_t);
opcode = cmd->cmnd[0];
- lba = sectors_to_logical(cmd->device, blk_rq_pos(cmd->request));
if (opcode == READ_10 || opcode == WRITE_10) {
/*
@@ -397,6 +396,7 @@ static void ufshcd_add_command_trace(str
*/
transfer_len =
be32_to_cpu(lrbp->ucd_req_ptr->sc.exp_data_transfer_len);
+ lba = scsi_get_lba(cmd);
if (opcode == WRITE_10)
group_id = lrbp->cmd->cmnd[6];
} else if (opcode == UNMAP) {
@@ -404,6 +404,7 @@ static void ufshcd_add_command_trace(str
* The number of Bytes to be unmapped beginning with the lba.
*/
transfer_len = blk_rq_bytes(cmd->request);
+ lba = scsi_get_lba(cmd);
}
intr = ufshcd_readl(hba, REG_INTERRUPT_STATUS);