[PATCH 0/5] scsi: ufs: Fix descriptor parsing and invalid input handling

[liqiang]

From: Li Qiang <liqiang01@xxxxxxxxxx>

This series fixes five independently triggerable UFS robustness issues.

The first patch validates string descriptor payload sizes and avoids raw
descriptor overreads. The remaining patches protect command completion and
MCQ cleanup, validate connected lane counts, validate RPMB frame sizes before
parsing, and retain a NUL terminator for debugfs input.

The series was built with x86_64 defconfig plus UFS, RPMB, and debugfs.

Li Qiang (5):
  scsi: ufs: core: Validate string descriptors
  scsi: ufs: Fix NULL dereferences after tag lookup
  scsi: ufs: core: Validate connected lane counts
  scsi: ufs: rpmb: Validate frame before parsing
  scsi: ufs: debugfs: Reserve space for a string terminator

 drivers/ufs/core/ufs-debugfs.c |  2 +-
 drivers/ufs/core/ufs-mcq.c     |  6 ++++--
 drivers/ufs/core/ufs-rpmb.c    |  8 ++++++--
 drivers/ufs/core/ufshcd.c      | 35 +++++++++++++++++++++++++---------
 4 files changed, 37 insertions(+), 14 deletions(-)

-- 
2.43.0