RE: [PATCH v2] ufs: core: bsg: Fix memory crash in case arpmb command failed

[Arthur Simchaev]

> 
> very strange,  I didn't reproduce this issue with the same command, but I saw
> the problem job->result was not updated.
> 
> 
> it should not be job->reply_len issue, since we initiated the max_response_len,
> then:
> 
> int len = min(hdr->max_response_len, job->reply_len);
> 
> 
> could you check if this works:
> 
> 
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index
> 8d4ad0a3f2cf..943382b142ca 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -195,9 +195,9 @@ static int ufs_bsg_request(struct bsg_job *job)
>         kfree(buff);
>         bsg_reply->result = ret;
>         job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) :
> sizeof(struct ufs_rpmb_reply);
> -       /* complete the job here only if no error */
> -       if (ret == 0)
> -               bsg_job_done(job, ret, bsg_reply-
> >reply_payload_rcv_len);
> +
> +       /* complete the job here */
> +       bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
> 
>         return ret;
>  }
> 
> 
> Kind regards,
> Bean

Also, this change fix the crash, but ufs-utils didn't get the error message
With my patch the tool got an error value of -22 (-EINVAL), as expected

Regards
Arthur