Re: [PATCH v2 4/6] scsi: ufs: rpmb: Validate request frame length before parsing

[Bean Huo]

On Fri, 2026-07-17 at 23:39 +0800, Li Qiang wrote:
> The RPMB core only verifies that request and response buffers are
> 
> nonempty. This callback reads req_resp at the end of the first request
> 
> frame before validating the request length.
> 
> Require a complete frame before that access.
> 
> Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS
> devices")
> Signed-off-by: Li Qiang <liqiang01@xxxxxxxxxx>
> ---
>  drivers/ufs/core/ufs-rpmb.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
> index ffad049872b9..431f85b36876 100644
> --- a/drivers/ufs/core/ufs-rpmb.c
> +++ b/drivers/ufs/core/ufs-rpmb.c
> @@ -69,6 +69,10 @@ static int ufs_rpmb_route_frames(struct device *dev, u8
> *req, unsigned int req_l
>  
>         hba = ufs_rpmb->hba;
>  
> +       /* req_resp is at the end of an RPMB frame. */
> +       if (req_len < sizeof(*frm_out))
> +               return -EINVAL;
> +
>         req_type = be16_to_cpu(frm_out->req_resp);
>  
>         switch (req_type) {
> --
> 2.43.0

the two Sashiko findings are a separate story, this patch is ok to me.

Reviewed-by: Bean Huo <beanhuo@xxxxxxxxxx>