Jaegeuk Kim b51f784248 FROMLIST: scsi: ufs: WB is only available on LUN #0 to #7 ... Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from rpmb lun. The reason is the unit descriptor length is different per LU. The lengh of Normal LU is 45, while the one of rpmb LU is 35. int ufshcd_read_desc_param(struct ufs_hba *hba, ...) { param_offset=41; param_size=4; buff_len=45; ... buff_len=35 by rpmb LU; if (is_kmalloc) { /* Make sure we don't copy more data than available */ if (param_offset + param_size > buff_len) param_size = buff_len - param_offset; --> param_size = 250; memcpy(param_read_buf, &desc_buf[param_offset], param_size); --> memcpy(param_read_buf, desc_buf+41, 250); [ 141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c } } Bug: 174701661 Link: https://lore.kernel.org/linux-scsi/20210111095927.1830311-1-jaegeuk@kernel.org/ Reviewed-by: Avri Altman <avri.altman@wdc.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@google.com> Change-Id: I25205d465daa25b4bd330876ad05fcfd01195a56		2021-01-12 16:51:36 -08:00
..
accessibility	speakup: fix uninitialized flush_lock	2020-12-30 11:53:44 +01:00
acpi	ACPI: PNP: compare the string length in the matching_id()	2020-12-30 11:54:06 +01:00
amba
android	ANDROID: Sched: Add hooks for scheduler	2021-01-08 02:01:31 +00:00
ata
atm	atm: nicstar: Unmap DMA on send error	2020-11-18 16:42:07 -08:00
auxdisplay
base	UPSTREAM: PM: domains: create debugfs nodes when adding power domains	2021-01-12 12:57:37 -08:00
bcma
block	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
bluetooth	Bluetooth: hci_h5: close serdev device and free hu in h5_close	2021-01-06 14:56:51 +01:00
bus	bus: fsl-mc: fix error return code in fsl_mc_object_allocate()	2020-12-30 11:53:46 +01:00
cdrom
char	Merge 5.10.5 into android12-5.10	2021-01-10 12:19:03 +01:00
clk	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
clocksource	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
connector
counter	counter: microchip-tcb-capture: Fix CMR value check	2020-12-30 11:54:26 +01:00
cpufreq	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
cpuidle	ANDROID: vendor_hook: modify cpuidle vendor hook	2021-01-04 18:51:30 +00:00
crypto	crypto: atmel-i2c - select CONFIG_BITREVERSE	2020-12-30 11:53:50 +01:00
dax	device-dax: Fix range release	2021-01-06 14:56:56 +01:00
dca
devfreq
dio
dma	dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0	2020-12-30 11:53:51 +01:00
dma-buf	FROMGIT: dma-buf: cma_heap: Fix memory leak in CMA heap	2021-01-12 21:13:33 +00:00
edac	EDAC/amd64: Fix PCI component registration	2020-12-30 11:54:11 +01:00
eisa
extcon	extcon: max77693: Fix modalias string	2020-12-30 11:53:49 +01:00
firewire
firmware	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
fpga	fpga: Specify HAS_IOMEM dependency for FPGA_DFL	2020-12-01 18:46:24 +01:00
fsi	fsi: Aspeed: Add mutex to protect HW access	2020-12-30 11:53:46 +01:00
gnss
gpio	gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask	2020-12-30 11:53:51 +01:00
gpu	Merge 5.10.5 into android12-5.10	2021-01-10 12:19:03 +01:00
greybus
hid	This is the 5.10.3 stable release	2020-12-27 11:18:19 +01:00
hsi	HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()	2020-12-30 11:53:24 +01:00
hv
hwmon	hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable	2020-12-30 11:53:31 +01:00
hwspinlock
hwtracing	coresight: remove broken __exit annotations	2020-12-30 11:53:44 +01:00
i2c	Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"	2020-12-30 11:52:57 +01:00
i3c	i3c master: fix missing destroy_workqueue() on error in i3c_master_register	2021-01-06 14:56:53 +01:00
ide
idle	intel_idle: Build fix	2020-12-03 10:00:23 +01:00
iio	iio:adc:ti-ads124s08: Fix alignment and data leak issues.	2020-12-30 11:54:25 +01:00
infiniband	RDMA/cma: Don't overwrite sgid_attr after device is released	2020-12-30 11:53:53 +01:00
input	Input: cyapa_gen6 - fix out-of-bounds stack access	2020-12-30 11:54:05 +01:00
interconnect	interconnect: fix memory trashing in of_count_icc_providers()	2020-11-20 16:01:35 +02:00
iommu	ANDROID: iommu/io-pgtable-arm: Add support to use system cache with NWA policy	2021-01-12 20:11:03 +00:00
ipack
irqchip	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
isdn
leds	leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI	2020-12-30 11:53:22 +01:00
lightnvm
macintosh	macintosh/adb-iop: Send correct poll command	2020-12-30 11:53:39 +01:00
mailbox	mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree	2020-12-30 11:53:28 +01:00
mcb
md	Merge 5.10.5 into android12-5.10	2021-01-10 12:19:03 +01:00
media	Merge 5.10.5 into android12-5.10	2021-01-10 12:19:03 +01:00
memory	memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm	2020-12-30 11:54:27 +01:00
memstick	memstick: r592: Fix error return in r592_probe()	2020-12-30 11:53:34 +01:00
message
mfd	mfd: cpcap: Fix interrupt regression with regmap clear_ack	2020-12-30 11:53:16 +01:00
misc	Merge 5.10.5 into android12-5.10	2021-01-10 12:19:03 +01:00
mmc	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
most
mtd	mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments	2020-12-30 11:54:23 +01:00
mux
net	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
nfc	nfc: s3fwrn5: Release the nfc firmware	2020-12-30 11:53:53 +01:00
ntb
nubus
nvdimm	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels	2020-12-30 11:54:27 +01:00
nvme
nvmem
of
opp	opp: Call the missing clk_put() on error	2021-01-06 14:56:49 +01:00
oprofile
parisc
parport
pci	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
pcmcia
perf
phy	drm/mediatek: avoid dereferencing a null hdmi_phy on an error message	2020-12-30 11:53:43 +01:00
pinctrl	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
platform	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
pnp
power	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
powercap
pps
ps3	powerpc/ps3: use dma_mapping_error()	2020-12-30 11:53:53 +01:00
ptp	ptp: clockmatrix: bug fix for idtcm_strverscmp	2020-11-25 17:24:49 -08:00
pwm	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
rapidio
ras
regulator	regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x	2020-12-30 11:54:28 +01:00
remoteproc	remoteproc: sysmon: Ensure remote notification ordering	2020-12-30 11:54:28 +01:00
reset
rpmsg
rtc	rtc: pl031: fix resource leak in pl031_probe	2021-01-06 14:56:53 +01:00
s390	s390/dasd: fix list corruption of lcu list	2020-12-30 11:54:09 +01:00
sbus
scsi	FROMLIST: scsi: ufs: WB is only available on LUN #0 to #7	2021-01-12 16:51:36 -08:00
sfi
sh
siox
slimbus	slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew()	2020-12-30 11:53:47 +01:00
soc	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
soundwire	soundwire: master: use pm_runtime_set_active() on add	2020-12-30 11:53:28 +01:00
spi	Merge 5.10.5 into android12-5.10	2021-01-10 12:19:03 +01:00
spmi
ssb
staging	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
target	SCSI fixes on 20201120	2020-11-20 16:24:28 -08:00
tc
tee	ARM: SoC fixes for v5.10, part 3	2020-11-27 14:48:03 -08:00
thermal	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
thunderbolt	thunderbolt: Fix use-after-free in remove_unplugged_switch()	2020-11-19 17:44:10 +03:00
tty	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
uio
usb	FROMGIT: usb: typec: ucsi: Add support for USB role switch	2021-01-12 23:26:46 +00:00
vdpa	vdpa/mlx5: Use write memory barrier after updating CQ index	2020-12-30 11:54:00 +01:00
vfio	vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU	2020-12-30 11:54:03 +01:00
vhost	vhost scsi: fix error return code in vhost_scsi_set_endpoint()	2020-12-30 11:54:00 +01:00
video	fbcon: Disable accelerated scrolling	2021-01-06 14:56:51 +01:00
virt
virtio	Merge 5.10.4 into android12-5.10	2020-12-30 12:47:03 +01:00
visorbus
vlynq
vme
w1
watchdog	watchdog: rti-wdt: fix reference leak in rti_wdt_probe	2021-01-06 14:56:54 +01:00
xen	xenbus/xenbus_backend: Disallow pending watch messages	2020-12-30 11:54:27 +01:00
zorro
Kconfig
Makefile	vdpa: mlx5: fix vdpa/vhost dependencies	2020-12-02 04:09:56 -05:00