Hi Bart, >If param_offset > buff_len then the memcpy() statement in >ufshcd_read_desc_param() corrupts memory since it copies >256 + buff_len - param_offset bytes into a buffer with size buff_len. >Since param_offset < 256 this results in writing past the bound of the >output buffer. Reviewed-by: Daejun Park <daejun7.park@xxxxxxxxxxx> Thanks, Daejun
