6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Stanley Jhu [ Upstream commit 2e63ac76cc08ea376ba61fef52f7b7849e35024d ] The reply buffer is allocated once per tag and reused. Requests that complete with a positive status do not fill all of it, so user space receives bytes from an earlier request on the same tag. Clear the whole reply buffer on entry to ufs_bsg_request(). Fixes: 95e34bf930ea ("scsi: ufs-bsg: Add support for raw upiu in ufs_bsg_request()") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261015001855.3450573-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) Signed-off-by: Sasha Levin --- drivers/ufs/core/ufs_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c index 237ade1f0cd83..0e0b08a3821c4 100644 --- a/drivers/ufs/core/ufs_bsg.c +++ b/drivers/ufs/core/ufs_bsg.c @@ -142,7 +142,7 @@ static int ufs_bsg_request(struct bsg_job *job) int ret; bool rpmb = false; - bsg_reply->reply_payload_rcv_len = 0; + memset(job->reply, 0, job->reply_len); ufshcd_rpm_get_sync(hba); -- 2.53.0