Re: [PATCH v2 0/5] scsi: ufs: Fix UIC result byte and BSG request handling

[Martin K. Petersen (Oracle)]

On Thu, 15 Oct 2026 08:18:50 +0800, Stanley Jhu wrote:

> ufs-bsg fixes for issues found by fuzzing /dev/bsg/ufs-bsg* with
> syzkaller on QEMU's emulated UFS host controller and in review of v1,
> plus a fix for peer DME retries.
> 
> Patch 1 completes failed BSG requests via bsg_job_done() so error paths
> do not leak the job's device reference and mapped scatterlists.
> Patch 2 clears the reused reply buffer so replies do not carry bytes
> from an earlier request.
> Patch 3 rejects requests shorter than the UFS BSG request structures.
> Patch 4 rejects UIC commands with a non-zero result byte from userspace.
> Patch 5 clears the stale UIC result byte and restores argument3 before
> peer DME retries.
> 
> [...]

Applied to 7.4/scsi-queue, thanks!

[1/5] scsi: ufs: bsg: Complete the job on error
      https://git.kernel.org/mkp/scsi/c/cc0ce3fe8fac
[2/5] scsi: ufs: bsg: Clear the reply buffer before use
      https://git.kernel.org/mkp/scsi/c/2e63ac76cc08
[3/5] scsi: ufs: bsg: Validate request_len before accessing request
      https://git.kernel.org/mkp/scsi/c/42aa44371810
[4/5] scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
      https://git.kernel.org/mkp/scsi/c/1ae42513205a
[5/5] scsi: ufs: core: Clear stale UIC result byte before peer DME retries
      https://git.kernel.org/mkp/scsi/c/e4a9b7640914

-- 
Martin K. Petersen