[PATCH 0/3] scsi: ufs: Fix UIC result byte and BSG request length handling

[Stanley Jhu]

Two ufs-bsg fixes for issues found by fuzzing /dev/bsg/ufs-bsg* with
syzkaller on QEMU's emulated UFS host controller, plus a related fix
for the same UIC result byte problem in the peer DME retry path.

Patch 1 rejects requests shorter than the UFS BSG request structures.
Patch 2 clears the UIC result byte supplied by userspace.
Patch 3 clears the stale UIC result byte before peer DME retries.

Tested on QEMU arm64: the reproducers no longer trigger.

Stanley Jhu (3):
  scsi: ufs: bsg: Validate request_len before accessing request
  scsi: ufs: bsg: Clear the UIC result byte before sending UIC commands
  scsi: ufs: core: Clear stale UIC result byte before peer DME retries

 drivers/ufs/core/ufs_bsg.c | 9 +++++++++
 drivers/ufs/core/ufshcd.c  | 2 ++
 2 files changed, 11 insertions(+)

-- 
2.56.0.385.gd3acb90ef8-goog