git: 7fb453f00502 - stable/15 - ufshci: validate the CDB before allocating a request

The branch stable/15 has been updated by jaeyoon:

URL: https://cgit.FreeBSD.org/src/commit/?id=7fb453f00502c522656f44715f2a55a0313e76d0

commit 7fb453f00502c522656f44715f2a55a0313e76d0
Author:     Jaeyoon Choi <jaeyoon@FreeBSD.org>
AuthorDate: 2026-08-18 04:51:42 +0000
Commit:     Jaeyoon Choi <jaeyoon@FreeBSD.org>
CommitDate: 2026-10-06 06:28:02 +0000

    ufshci: validate the CDB before allocating a request
    
    The CDB pointer and length checks depend only on the CCB, so perform
    them before allocating and initializing the request. This avoids a
    wasted allocation for invalid CCBs on the I/O path and removes one
    request-free error path.
    
    Reviewed by:            imp (mentor)
    Sponsored by:           Samsung Electronics
    Differential Revision:  https://reviews.freebsd.org/D58817
    
    (cherry picked from commit f3c3db35d545bb14b96e4cb079312c377247540b)
---
 sys/dev/ufshci/ufshci_sim.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/sys/dev/ufshci/ufshci_sim.c b/sys/dev/ufshci/ufshci_sim.c
index f969d9c8311b..8ac47fc4a2dc 100644
--- a/sys/dev/ufshci/ufshci_sim.c
+++ b/sys/dev/ufshci/ufshci_sim.c
@@ -144,6 +144,17 @@ ufshchi_sim_scsiio(struct cam_sim *sim, union ccb *ccb)
 	payload_len = csio->dxfer_len;
 	is_write = csio->ccb_h.flags & CAM_DIR_OUT;
 
+	if (csio->ccb_h.flags & CAM_CDB_POINTER)
+		cdb = csio->cdb_io.cdb_ptr;
+	else
+		cdb = csio->cdb_io.cdb_bytes;
+
+	if (cdb == NULL || csio->cdb_len > sizeof(upiu->cdb)) {
+		ccb->ccb_h.status = CAM_REQ_INVALID;
+		xpt_done(ccb);
+		return;
+	}
+
 	/* TODO: Check other data type */
 	if ((csio->ccb_h.flags & CAM_DATA_MASK) == CAM_DATA_BIO)
 		req = ufshci_allocate_request_bio((struct bio *)payload,
@@ -184,17 +195,6 @@ ufshchi_sim_scsiio(struct cam_sim *sim, union ccb *ccb)
 
 	upiu->expected_data_transfer_length = htobe32(payload_len);
 
-	if (csio->ccb_h.flags & CAM_CDB_POINTER)
-		cdb = csio->cdb_io.cdb_ptr;
-	else
-		cdb = csio->cdb_io.cdb_bytes;
-
-	if (cdb == NULL || csio->cdb_len > sizeof(upiu->cdb)) {
-		ccb->ccb_h.status = CAM_REQ_INVALID;
-		ufshci_free_request(req);
-		xpt_done(ccb);
-		return;
-	}
 	memcpy(upiu->cdb, cdb, csio->cdb_len);
 
 	ccb->ccb_h.status |= CAM_SIM_QUEUED;