On Mon, 2022-11-21 at 17:46 +0200, Arthur Simchaev wrote: ............ > - if (param_offset >= buff_len) { > - dev_err(hba->dev, "%s: Invalid offset 0x%x in > descriptor IDN 0x%x, length 0x%x\n", > - __func__, param_offset, desc_id, buff_len); > - return -EINVAL; > - } > - > /* Check whether we need temp memory */ > if (param_offset != 0 || param_size < buff_len) { > desc_buf = kzalloc(buff_len, GFP_KERNEL); > @@ -3434,15 +3407,23 @@ int ufshcd_read_desc_param(struct ufs_hba > *hba, > > /* Request for full descriptor */ > ret = ufshcd_query_descriptor_retry(hba, > UPIU_QUERY_OPCODE_READ_DESC, > - desc_id, desc_index, 0, > - desc_buf, &buff_len); > - > + desc_id, desc_index, 0, > + desc_buf, &buff_len); > if (ret) { > dev_err(hba->dev, "%s: Failed reading descriptor. > desc_id %d, desc_index %d, param_offset %d, ret %d\n", > __func__, desc_id, desc_index, param_offset, > ret); > goto out; > } > > + /* Update descriptor length */ > + buff_len = desc_buf[QUERY_DESC_LENGTH_OFFSET]; > + > + if (param_offset >= buff_len) { > + dev_err(hba->dev, "%s: Invalid offset 0x%x in > descriptor IDN 0x%x, length 0x%x\n", > + __func__, param_offset, desc_id, buff_len); > + return -EINVAL; > + } > + a little bit concerned here, but understood your point that you want to anyway read descriptor, then check if param_offset is a valid input. I think, there is no problem. All in all, this series is a very nice cleanup, we removed all unnecessary if-state, and complicated rules, making code more readable than before. Reviewed-by: Bean Huo <beanhuo@xxxxxxxxxx> Thanks, Bean