Merge tag 'u-boot-ufs-20260427' of https://source.denx.de/u-boot/custodians/u-boot-ufs

- Update line reset configuration for rcar-gen5
- core: Fix heap corruption due to out of bounds write
- rockchip: Make use of controller resets

3 files changed, 29 insertions, 10 deletions

diff --git a/drivers/ufs/ufs-renesas-rcar-gen5.c b/drivers/ufs/ufs-renesas-rcar-gen5.c
index a21ae3f390e..a9473cd60b1 100644
--- a/drivers/ufs/ufs-renesas-rcar-gen5.c
+++ b/drivers/ufs/ufs-renesas-rcar-gen5.c
@@ -92,14 +92,14 @@ static int ufs_renesas_pre_init(struct ufs_hba *hba)
 	ufs_dme_command(hba, 0x00000002, 0x81010000, 0x00000000, 0x00000005);
 	ufs_dme_command(hba, 0x00000002, 0x81150000, 0x00000000, 0x00000001);
 	ufs_dme_command(hba, 0x00000002, 0x81180000, 0x00000000, 0x00000001);
-	ufs_dme_command(hba, 0x00000002, 0x80090000, 0x00000000, 0x00000000);
-	ufs_dme_command(hba, 0x00000002, 0x800a0000, 0x00000000, 0x000000c8);
-	ufs_dme_command(hba, 0x00000002, 0x80090001, 0x00000000, 0x00000000);
-	ufs_dme_command(hba, 0x00000002, 0x800a0001, 0x00000000, 0x000000c8);
-	ufs_dme_command(hba, 0x00000002, 0x800a0004, 0x00000000, 0x00000000);
-	ufs_dme_command(hba, 0x00000002, 0x800b0004, 0x00000000, 0x00000064);
-	ufs_dme_command(hba, 0x00000002, 0x800a0005, 0x00000000, 0x00000000);
-	ufs_dme_command(hba, 0x00000002, 0x800b0005, 0x00000000, 0x00000064);
+	ufs_dme_command(hba, 0x00000002, 0x80090000, 0x00000000, 0x0000000c);
+	ufs_dme_command(hba, 0x00000002, 0x800a0000, 0x00000000, 0x00000080);
+	ufs_dme_command(hba, 0x00000002, 0x80090001, 0x00000000, 0x0000000c);
+	ufs_dme_command(hba, 0x00000002, 0x800a0001, 0x00000000, 0x00000080);
+	ufs_dme_command(hba, 0x00000002, 0x800a0004, 0x00000000, 0x00000003);
+	ufs_dme_command(hba, 0x00000002, 0x800b0004, 0x00000000, 0x000000ea);
+	ufs_dme_command(hba, 0x00000002, 0x800a0005, 0x00000000, 0x00000003);
+	ufs_dme_command(hba, 0x00000002, 0x800b0005, 0x00000000, 0x000000ea);
 	ufs_dme_command(hba, 0x00000002, 0xd0850000, 0x00000000, 0x00000001);
 
 	writew(0x0001, priv->phy_base + 0x20000);
diff --git a/drivers/ufs/ufs-rockchip.c b/drivers/ufs/ufs-rockchip.c
index a13236c7f76..dc4b9b5c86d 100644
--- a/drivers/ufs/ufs-rockchip.c
+++ b/drivers/ufs/ufs-rockchip.c
@@ -19,13 +19,22 @@
 #include "unipro.h"
 #include "ufs-rockchip.h"
 
+static void ufs_rockchip_controller_reset(struct ufs_rockchip_host *host)
+{
+	reset_assert_bulk(&host->rsts);
+	udelay(1);
+	reset_deassert_bulk(&host->rsts);
+}
+
 static int ufs_rockchip_hce_enable_notify(struct ufs_hba *hba,
 					  enum ufs_notify_change_status status)
 {
 	int err = 0;
 
-	if (status != POST_CHANGE)
+	if (status != POST_CHANGE) {
+		ufs_rockchip_controller_reset(dev_get_priv(hba->dev));
 		return 0;
+	}
 
 	ufshcd_dme_reset(hba);
 	ufshcd_dme_enable(hba);
@@ -150,6 +159,8 @@ static int ufs_rockchip_common_init(struct ufs_hba *hba)
 		return err;
 	}
 
+	ufs_rockchip_controller_reset(host);
+
 	err = gpio_request_by_name(dev, "reset-gpios", 0, &host->device_reset,
 				   GPIOD_IS_OUT | GPIOD_ACTIVE_LOW);
 	if (err) {
diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c
index 81fd431f951..6a51f337e47 100644
--- a/drivers/ufs/ufs-uclass.c
+++ b/drivers/ufs/ufs-uclass.c
@@ -1751,7 +1751,15 @@ static int ufshcd_read_string_desc(struct ufs_hba *hba, int desc_index,
 			goto out;
 		}
 
-		buff_ascii = kmalloc(ascii_len, GFP_KERNEL);
+		/*
+		 * utf-8 is encoded using up to 4-Bytes per character,
+		 * however, we only allocate such a buffer because the
+		 * utf16_to_utf8() converts the entire $ascii_len worth
+		 * of input characters into up to 4-Byte long utf-8
+		 * characters. The rest of the function uses only up to
+		 * $ascii_len bytes of that utf-8 string.
+		 */
+		buff_ascii = kmalloc(ascii_len * 4, GFP_KERNEL);
 		if (!buff_ascii) {
 			err = -ENOMEM;
 			goto out;