Re: [PATCH v2 0/5] scsi: ufs: Fix UIC result byte and BSG request handling

[Peter Wang]

On Thu, 2026-10-15 at 08:18 +0800, Stanley Jhu wrote:
> ufs-bsg fixes for issues found by fuzzing /dev/bsg/ufs-bsg* with
> syzkaller on QEMU's emulated UFS host controller and in review of v1,
> plus a fix for peer DME retries.
> 
> Patch 1 completes failed BSG requests via bsg_job_done() so error
> paths
> do not leak the job's device reference and mapped scatterlists.
> Patch 2 clears the reused reply buffer so replies do not carry bytes
> from an earlier request.
> Patch 3 rejects requests shorter than the UFS BSG request structures.
> Patch 4 rejects UIC commands with a non-zero result byte from
> userspace.
> Patch 5 clears the stale UIC result byte and restores argument3
> before
> peer DME retries.
> 
> Patches 1-2 also address the sashiko review of the bsg reply_len
> patch:
> https://lore.kernel.org/all/sashiko-outbox-169843@xxxxxxxxxx/ ;
> 
> Tested on QEMU arm64: the reproducers no longer trigger.
> 
> Differences from v1:
> - New patch 1/5: complete failed jobs via bsg_job_done().
> - New patch 2/5: clear the reply buffer on entry.
> - Patch 4/5: reject non-zero UIC result byte with -EINVAL (Bart).
> - Patch 5/5: restore argument3 on each retry in
> ufshcd_dme_set_attr().
> 
> Link:
> https://lore.kernel.org/all/20261013102913.948718-1-stanleyjhu@xxxxxxxxxx/
>  
> 
> Stanley Jhu (5):
>   scsi: ufs: bsg: Complete the job on error
>   scsi: ufs: bsg: Clear the reply buffer before use
>   scsi: ufs: bsg: Validate request_len before accessing request
>   scsi: ufs: bsg: Reject UIC commands with a non-zero result byte
>   scsi: ufs: core: Clear stale UIC result byte before peer DME
> retries
> 
>  drivers/ufs/core/ufs_bsg.c | 23 +++++++++++++++++------
>  drivers/ufs/core/ufshcd.c  |  9 +++++++--
>  2 files changed, 24 insertions(+), 8 deletions(-)
> 
> base-commit: 9621cbd332862eb6651e2aba24ed18f66560de66

For the series:
Reviewed-by: Peter Wang <peter.wang@xxxxxxxxxxxx>