Re: [PATCH v2 5/6] scsi: ufs: rpmb: Use unaligned accessors for RPMB frames

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but while the patch correctly fixes unaligned memory accesses in the UFS RPMB backend, identical unsafe accesses remain unpatched in the MMC RPMB backend. Additionally, a structural fix using `__packed` on `struct rpmb_frame` is missing, which would safely handle unaligned access for all backends globally.
--

--- Patch [5]: [PATCH v2 5/6] scsi: ufs: rpmb: Use unaligned accessors for RPMB frames ---
commit 521f1f28960728ee9f0014bd2898bd36bb94fa39
Author: Li Qiang <liqiang01@kylinos.cn>

scsi: ufs: rpmb: Use unaligned accessors for RPMB frames

RPMB frame buffers are passed as u8 pointers and do not have an
alignment guarantee. This commit uses unaligned accessors for the req_resp
field to prevent alignment fault traps.

> diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
> index 431f85b368760..53f66b274acac 100644
> --- a/drivers/ufs/core/ufs-rpmb.c
> +++ b/drivers/ufs/core/ufs-rpmb.c
> @@ -73,7 +73,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
>  	if (req_len < sizeof(*frm_out))
>  		return -EINVAL;
>  
> -	req_type = be16_to_cpu(frm_out->req_resp);
> +	req_type = get_unaligned_be16(&frm_out->req_resp);

[Severity: High]
This is a pre-existing issue, but while this correctly fixes the unaligned
memory access in the UFS RPMB backend, does it make sense to fix this globally
by adding the __packed attribute to struct rpmb_frame in include/linux/rpmb.h?

Currently, identical unsafe accesses remain unpatched in the MMC RPMB backend,
such as in mmc_route_rpmb_frames() in drivers/mmc/core/block.c:

drivers/mmc/core/block.c:mmc_route_rpmb_frames() {
	...
	req_type = be16_to_cpu(frm->req_resp);
	...
	resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
	...
}

An RPC call from the TEE secure world (e.g., OP-TEE) passing an unaligned
shm_offs to the kernel for an RPMB routing request
(handle_rpc_func_rpmb_frames) can cause tee_shm_get_va() to return an
unaligned u8 * pointer.

The MMC driver casts this to struct rpmb_frame * and dereferences req_resp,
which can trigger an alignment fault trap and kernel panic on architectures
that do not support unaligned memory access.

Would adding __packed to struct rpmb_frame instruct the compiler to safely
generate unaligned accesses for all members globally, avoiding brittle
driver-by-driver accessor fixes?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717153914.26321-1-liqiang01@kylinos.cn?part=5