Re: [PATCH v3 2/2] scsi: ufs: Add support for the aggregated read query opcode

On 7/23/26 8:27 PM, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider: - [High] The patch introduces a dedicated DMA
> allocation for the device management command descriptor
> (`devman_ucd_base_addr`) and restricts its Physical Region
> Descriptor Table (PRDT) size to only 2 entries
> (`UFSHCD_DEVMAN_SG_ENTRIES`). However, Advanced RPMB requests
> originating from userspace via the block layer's BSG interface are
> mapped into scatter-gather lists without enforcing this 2-entry
> limit. Because userspace can submit highly fragmented I/O vectors
> (or even a contiguous 4KB buffer that spans across three memory
> pages), the block layer can generate an `sg_cnt` greater than 2. The
> driver blindly passes this `sg_cnt` to `ufshcd_sgl_to_prdt()`, which
> iterates over the scatterlist and writes beyond the bounds of the 2-
> entry `prd_table`. This results in a silent out-of-bounds write that
> corrupts adjacent DMA-coherent memory.
I think this comment should be addressed. How about addressing this by 
checking payload->sg_cnt in ufs_bsg.c before calling dma_map()?

Thanks,

Bart.