very strange, I didn't reproduce this issue with the same command, but I saw the problem job->result was not updated.
it should not be job->reply_len issue, since we initiated the max_response_len, then:
int len = min(hdr->max_response_len, job->reply_len);
could you check if this works:
diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 8d4ad0a3f2cf..943382b142ca 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -195,9 +195,9 @@ static int ufs_bsg_request(struct bsg_job *job) kfree(buff); bsg_reply->result = ret; job->reply_len = !rpmb ? sizeof(struct ufs_bsg_reply) : sizeof(struct ufs_rpmb_reply);
/* complete the job here only if no error */if (ret == 0)bsg_job_done(job, ret, bsg_reply-reply_payload_rcv_len);
/* complete the job here */bsg_job_done(job, ret, bsg_reply->reply_payload_rcv_len); return ret;}
Kind regards, Bean
Also, this change fix the crash, but ufs-utils didn't get the error message With my patch the tool got an error value of -22 (-EINVAL), as expected
Regards Arthur