st-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: af00e00f23a1d427d96fecbb39e276fc2d7dfde1 Auto-Submitted: auto-generated Date: Mon, 10 Aug 2026 02:31:29 +0000 Message-Id: <6a793801.1cdee.1f386bae@gitrepo.freebsd.org> The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=af00e00f23a1d427d96fecbb39e276fc2d7dfde1 commit af00e00f23a1d427d96fecbb39e276fc2d7dfde1 Author: Jaeyoon Choi AuthorDate: 2026-08-10 01:47:38 +0000 Commit: Jaeyoon Choi CommitDate: 2026-08-10 02:28:52 +0000 ufshci: initialize desc_size for non-descriptor query requests The flag and attribute query builders left param.desc_size uninitialized, so stack garbage was sent as the query UPIU length field. Devices generally ignore the length for these opcodes, which hid the bug. Zero it explicitly. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58665 --- sys/dev/ufshci/ufshci_dev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/dev/ufshci/ufshci_dev.c b/sys/dev/ufshci/ufshci_dev.c index 454572f966d5..18546d7120c0 100644 --- a/sys/dev/ufshci/ufshci_dev.c +++ b/sys/dev/ufshci/ufshci_dev.c @@ -86,6 +86,7 @@ ufshci_dev_read_flag(struct ufshci_controller *ctrlr, param.index = 0; param.selector = 0; param.value = 0; + param.desc_size = 0; status.done = 0; error = ufshci_ctrlr_cmd_send_query_request(ctrlr, @@ -118,6 +119,7 @@ ufshci_dev_set_flag(struct ufshci_controller *ctrlr, param.index = 0; param.selector = 0; param.value = 0; + param.desc_size = 0; status.done = 0; error = ufshci_ctrlr_cmd_send_query_request(ctrlr, @@ -148,6 +150,7 @@ ufshci_dev_clear_flag(struct ufshci_controller *ctrlr, param.index = 0; param.selector = 0; param.value = 0; + param.desc_size = 0; status.done = 0; error = ufshci_ctrlr_cmd_send_query_request(ctrlr, @@ -179,6 +182,7 @@ ufshci_dev_read_attribute(struct ufshci_controller *ctrlr, param.index = index; param.selector = selector; param.value = 0; + param.desc_size = 0; status.done = 0; error = ufshci_ctrlr_cmd_send_query_request(ctrlr, @@ -212,6 +216,7 @@ ufshci_dev_write_attribute(struct ufshci_controller *ctrlr, param.index = index; param.selector = selector; param.value = value; + param.desc_size = 0; status.done = 0; error = ufshci_ctrlr_cmd_send_query_request(ctrlr,