Re: [PATCH v2] ufs: core: bsg: Fix memory crash in case arpmb command failed

[Bart Van Assche]

On 2/18/25 3:15 AM, Arthur Simchaev wrote:
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
> index 8d4ad0a3f2cf..a8ed9bc6e4f1 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -194,10 +194,12 @@ static int ufs_bsg_request(struct bsg_job *job)
>   	ufshcd_rpm_put_sync(hba);
>   	kfree(buff);
>   	bsg_reply->result = ret;
> -	job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply);
>   	/* complete the job here only if no error */
> -	if (ret == 0)
> +	if (ret == 0) {
> +		job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) :
> +					 sizeof(struct ufs_rpmb_reply);
>   		bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len);
> +	}

Please make this code easier to read by changing !rpmb into rpmb and by
swapping the two sizeof() expressions.

Thanks,

Bart.