scsi: ufs: null terminate buffer that is sent to strlcpy

strlcpy() must get null-terminated buffer as a second argument because
inside strlcpy(), strlen() is invoked on that argument, and unterminated
buffer will result incorrect value.
In this case, str_desc_buf is a buffer that might return from
ufshcd_read_string_desc() when it is no longer null-terminated.
Therefor we must null-terminate it before sending it to strlcpy().

This change also fixes the type of the vendor variable that is read
from the device descriptor. According to UFS device specification this
field is 2 bytes wide. Its name is also changed to be compatible
with UFS device specification.

Change-Id: I3b1ba0311846881a1f3f1c984cc6f9d7109821b3
Signed-off-by: Yaniv Gardi <ygardi@codeaurora.org>

diff --git a/drivers/scsi/ufs/ufs_quirks.c b/drivers/scsi/ufs/ufs_quirks.c
index e1e8f37..869c877 100644 (file)
--- a/drivers/scsi/ufs/ufs_quirks.c
+++ b/drivers/scsi/ufs/ufs_quirks.c
@@ -23,7 +23,7 @@ int ufs_get_device_info(struct ufs_hba *hba, struct ufs_card_info *card_data)
 {
        int err;
        u8 model_index;
-       u8 str_desc_buf[QUERY_DESC_STRING_MAX_SIZE];
+       u8 str_desc_buf[QUERY_DESC_STRING_MAX_SIZE + 1];
        u8 desc_buf[QUERY_DESC_DEVICE_MAX_SIZE];
 
        err = ufshcd_read_device_desc(hba, desc_buf,
@@ -31,7 +31,13 @@ int ufs_get_device_info(struct ufs_hba *hba, struct ufs_card_info *card_data)
        if (err)
                goto out;
 
-       card_data->vendor = desc_buf[DEVICE_DESC_PARAM_MANF_ID + 1];
+       /*
+        * getting vendor (manufacturerID) and Bank Index in big endian
+        * format
+        */
+       card_data->wmanufacturerid = desc_buf[DEVICE_DESC_PARAM_MANF_ID] << 8 |
+                                    desc_buf[DEVICE_DESC_PARAM_MANF_ID + 1];
+
        model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME];
 
        memset(str_desc_buf, 0, QUERY_DESC_STRING_MAX_SIZE);
@@ -40,6 +46,7 @@ int ufs_get_device_info(struct ufs_hba *hba, struct ufs_card_info *card_data)
        if (err)
                goto out;
 
+       str_desc_buf[QUERY_DESC_STRING_MAX_SIZE] = '\0';
        strlcpy(card_data->model, str_desc_buf, MAX_MODEL_LEN + 1);
 out:
        return err;
@@ -51,7 +58,7 @@ void ufs_advertise_fixup_device(struct ufs_hba *hba)
        struct ufs_card_fix *f;
        struct ufs_card_info card_data;
 
-       card_data.vendor = 0;
+       card_data.wmanufacturerid = 0;
        card_data.model = kmalloc(MAX_MODEL_LEN + 1, GFP_KERNEL);
        if (!card_data.model)
                goto out;
@@ -64,9 +71,9 @@ void ufs_advertise_fixup_device(struct ufs_hba *hba)
        }
 
        for (f = ufs_fixups; f->quirk; f++) {
-               /* if same vendor */
-               if (((f->card.vendor == card_data.vendor) ||
-                    (f->card.vendor == UFS_ANY_VENDOR)) &&
+               /* if same wmanufacturerid */
+               if (((f->card.wmanufacturerid == card_data.wmanufacturerid) ||
+                    (f->card.wmanufacturerid == UFS_ANY_VENDOR)) &&
                    /* and same model */
                    (STR_PRFX_EQUAL(f->card.model, card_data.model) ||
                     !strcmp(f->card.model, UFS_ANY_MODEL)))

diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
index 41a7f19..3675e54 100644 (file)
--- a/drivers/scsi/ufs/ufs_quirks.h
+++ b/drivers/scsi/ufs/ufs_quirks.h
@@ -29,11 +29,11 @@
 
 /**
  * ufs_card_info - ufs device details
- * @vendor: card details
+ * @wmanufacturerid: card details
  * @model: card model
  */
 struct ufs_card_info {
-       unsigned int vendor;
+       u16 wmanufacturerid;
        char *model;
 };
 
@@ -51,10 +51,10 @@ struct ufs_card_fix {
 
 /* add specific device quirk */
 #define UFS_FIX(_vendor, _model, _quirk) \
-               {                                        \
-                               .card.vendor = (_vendor),\
-                               .card.model = (_model),  \
-                               .quirk = (_quirk),       \
+               {                                                 \
+                               .card.wmanufacturerid = (_vendor),\
+                               .card.model = (_model),           \
+                               .quirk = (_quirk),                \
                }
 
 /*