On Mon, 19 Jul 2021 16:11:22 -0700, Bart Van Assche wrote:
> If param_offset > buff_len then the memcpy() statement in
> ufshcd_read_desc_param() corrupts memory since it copies
> 256 + buff_len - param_offset bytes into a buffer with size buff_len.
> Since param_offset < 256 this results in writing past the bound of the
> output buffer.
Applied to 5.14/scsi-fixes, thanks!
[1/1] scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
https://git.kernel.org/mkp/scsi/c/b1d5de8c6ea2
--
Martin K. Petersen Oracle Linux Engineering
