From: Jaegeuk Kim <[email protected]> If param_offset is greater than what UFS supports, it'll give kernel panic.
Signed-off-by: Jaegeuk Kim <[email protected]> Change-Id: I48ea6f3f3074bd42abf4ecf8be87806732f3e6a3 --- drivers/scsi/ufs/ufshcd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index d6a3a0ba6960..04687661d0df 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -3194,6 +3194,9 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, return -EINVAL; } + if (param_offset > buff_len) + return -EINVAL; + /* Check whether we need temp memory */ if (param_offset != 0 || param_size < buff_len) { desc_buf = kmalloc(buff_len, GFP_KERNEL); -- 2.29.2.576.ga3fc446d84-goog
