git: af00e00f23a1 - main - ufshci: initialize desc_size for non-descriptor query requests

Jaeyoon Choi <[email protected]>
Newsgroups gmane.os.freebsd.devel.cvs.src
Message-ID <6a793801.1cdee.1f386bae__5417.3205442325$1786329239$gmane$org@gitrepo.freebsd.org>
The branch main has been updated by jaeyoon:

URL: https://cgit.FreeBSD.org/src/commit/?id=af00e00f23a1d427d96fecbb39e276fc2d7dfde1

commit af00e00f23a1d427d96fecbb39e276fc2d7dfde1
Author:     Jaeyoon Choi <[email protected]>
AuthorDate: 2026-08-10 01:47:38 +0000
Commit:     Jaeyoon Choi <[email protected]>
CommitDate: 2026-08-10 02:28:52 +0000

    ufshci: initialize desc_size for non-descriptor query requests
    
    The flag and attribute query builders left param.desc_size
    uninitialized, so stack garbage was sent as the query UPIU length
    field. Devices generally ignore the length for these opcodes, which
    hid the bug. Zero it explicitly.
    
    Sponsored by:           Samsung Electronics
    Reviewed by:            imp (mentor)
    Differential Revision:  https://reviews.freebsd.org/D58665
---
 sys/dev/ufshci/ufshci_dev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sys/dev/ufshci/ufshci_dev.c b/sys/dev/ufshci/ufshci_dev.c
index 454572f966d5..18546d7120c0 100644
--- a/sys/dev/ufshci/ufshci_dev.c
+++ b/sys/dev/ufshci/ufshci_dev.c
@@ -86,6 +86,7 @@ ufshci_dev_read_flag(struct ufshci_controller *ctrlr,
 	param.index = 0;
 	param.selector = 0;
 	param.value = 0;
+	param.desc_size = 0;
 
 	status.done = 0;
 	error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -118,6 +119,7 @@ ufshci_dev_set_flag(struct ufshci_controller *ctrlr,
 	param.index = 0;
 	param.selector = 0;
 	param.value = 0;
+	param.desc_size = 0;
 
 	status.done = 0;
 	error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -148,6 +150,7 @@ ufshci_dev_clear_flag(struct ufshci_controller *ctrlr,
 	param.index = 0;
 	param.selector = 0;
 	param.value = 0;
+	param.desc_size = 0;
 
 	status.done = 0;
 	error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -179,6 +182,7 @@ ufshci_dev_read_attribute(struct ufshci_controller *ctrlr,
 	param.index = index;
 	param.selector = selector;
 	param.value = 0;
+	param.desc_size = 0;
 
 	status.done = 0;
 	error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -212,6 +216,7 @@ ufshci_dev_write_attribute(struct ufshci_controller *ctrlr,
 	param.index = index;
 	param.selector = selector;
 	param.value = value;
+	param.desc_size = 0;
 
 	status.done = 0;
 	error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.