Re: [PATCH 1/3] scsi: ufs: bsg: Validate request_len before accessing request

[Stanley Jhu]

On Tue, Oct 13, 2026 at 10:44:34AM +0000, sashiko-bot@xxxxxxxxxx wrote:
> Later, ufs_bsg_request() sets job->reply_len to 104 for RPMB replies,
> which configures the block layer to copy 104 bytes to user space from
> this 96-byte allocation. Will this leak adjacent heap memory to userspace?

Pre-existing; fixed separately in bsg-lib:
https://lore.kernel.org/all/20261013132708.1669415-1-stanleyjhu@xxxxxxxxxx/

> Should this error path instead call bsg_job_done(job, -EINVAL, 0)
> and return 0 to ensure proper teardown?

Yes, done in v2 (1/5 and 3/5):
https://lore.kernel.org/all/20261015001855.3450573-1-stanleyjhu@xxxxxxxxxx/