git: af00e00f23a1 - main - ufshci: initialize desc_size for non-descriptor query requests
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 10 Aug 2026 02:31:29 UTC
The branch main has been updated by jaeyoon:
URL: https://cgit.FreeBSD.org/src/commit/?id=af00e00f23a1d427d96fecbb39e276fc2d7dfde1
commit af00e00f23a1d427d96fecbb39e276fc2d7dfde1
Author: Jaeyoon Choi <jaeyoon@FreeBSD.org>
AuthorDate: 2026-08-10 01:47:38 +0000
Commit: Jaeyoon Choi <jaeyoon@FreeBSD.org>
CommitDate: 2026-08-10 02:28:52 +0000
ufshci: initialize desc_size for non-descriptor query requests
The flag and attribute query builders left param.desc_size
uninitialized, so stack garbage was sent as the query UPIU length
field. Devices generally ignore the length for these opcodes, which
hid the bug. Zero it explicitly.
Sponsored by: Samsung Electronics
Reviewed by: imp (mentor)
Differential Revision: https://reviews.freebsd.org/D58665
---
sys/dev/ufshci/ufshci_dev.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sys/dev/ufshci/ufshci_dev.c b/sys/dev/ufshci/ufshci_dev.c
index 454572f966d5..18546d7120c0 100644
--- a/sys/dev/ufshci/ufshci_dev.c
+++ b/sys/dev/ufshci/ufshci_dev.c
@@ -86,6 +86,7 @@ ufshci_dev_read_flag(struct ufshci_controller *ctrlr,
param.index = 0;
param.selector = 0;
param.value = 0;
+ param.desc_size = 0;
status.done = 0;
error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -118,6 +119,7 @@ ufshci_dev_set_flag(struct ufshci_controller *ctrlr,
param.index = 0;
param.selector = 0;
param.value = 0;
+ param.desc_size = 0;
status.done = 0;
error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -148,6 +150,7 @@ ufshci_dev_clear_flag(struct ufshci_controller *ctrlr,
param.index = 0;
param.selector = 0;
param.value = 0;
+ param.desc_size = 0;
status.done = 0;
error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -179,6 +182,7 @@ ufshci_dev_read_attribute(struct ufshci_controller *ctrlr,
param.index = index;
param.selector = selector;
param.value = 0;
+ param.desc_size = 0;
status.done = 0;
error = ufshci_ctrlr_cmd_send_query_request(ctrlr,
@@ -212,6 +216,7 @@ ufshci_dev_write_attribute(struct ufshci_controller *ctrlr,
param.index = index;
param.selector = selector;
param.value = value;
+ param.desc_size = 0;
status.done = 0;
error = ufshci_ctrlr_cmd_send_query_request(ctrlr,