Re: [PATCH v2 4/5] scsi: ufs: bsg: Reject UIC commands with a non-zero result byte

[Bean Huo]

On Thu, 2026-10-15 at 08:18 +0800, Stanley Jhu wrote:
> ufs_bsg_request() passes the user-supplied UIC argument2 unchanged,
> including the result byte (bits 7:0) that only the host controller
> writes. A non-zero value triggers the WARN_ON_ONCE() in
> ufshcd_dispatch_uic_cmd() and corrupts the reported result. Found by
> syzkaller.
> 
> Reject UIC commands that have the result byte set with -EINVAL.
> 
> Fixes: e77044c5a842 ("scsi: ufs-bsg: Add support for uic commands in
> ufs_bsg_request()")
> Fixes: 9fb4c793223b ("scsi: ufs: core: Complain if UIC argument 2 is invalid")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Stanley Jhu <stanleyjhu@xxxxxxxxxx>

Reviewed-by: Bean Huo <beanhuo@xxxxxxxxxx>